Task Scheduler Vulnerability in Cronicle by JHuckaby

CVE-2026-39401

What is CVE-2026-39401?

Cronicle, a multi-server task scheduling application, contains a vulnerability that allows low-privilege users to manipulate event properties without proper authorization checks. Specifically, in versions prior to 0.9.111, child processes can output JSON data containing an 'update_event' key, which the server incorrectly applies to the parent event's configuration. This flaw enables unauthorized changes to critical event attributes, such as webhook URLs and notification emails. Users are urged to upgrade to version 0.9.111 or later to mitigate this risk.

References