XSS Vulnerability in Cronicle Multi-Server Task Scheduler

CVE-2026-55562

What is CVE-2026-55562?

In Cronicle, prior to version 0.9.119, there is a Cross-Site Scripting vulnerability affecting the administrator Activity Log. This vulnerability arises because an attacker can manipulate the 'item.user.full_name' value to inject malicious scripts into the application’s HTML output. An authenticated non-administrator can exploit this vulnerability to update their own name through the API with a valid session, or if free accounts are enabled, an anonymous attacker could register a malicious name. When an administrator views the Activity Log, the injected script can execute in their session, potentially allowing the attacker to take over administrative privileges and execute commands using elevated access features of Cronicle. Users are advised to upgrade to version 0.9.119 or later to mitigate this risk.

References