CVE-2026-58255

The Cronicle multi-server task scheduler and runner (prior to version 0.9.121 ) contains a vulnerability allowing non-administrator users or scoped API keys with create_events and run_events privileges to inject top-level uid and gid fields. This occurs because lib/api.js uses validateOptionalPar...