CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...