CVE-2026-39401 Privilege Escalation via update_event Job Output in Cronicle
Low-privilege users can modify any event configuration, including webhooks and emails, by injecting update_event keys in job output, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-39401?
CVE-2026-39401 is a medium-severity missing authorization vulnerability in jhuckaby Cronicle, published on 7 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.
Weakness: CWE-862
Which versions are affected by CVE-2026-39401?
It affects 1 product.
Products include Cronicle Cronicle.
How do I fix CVE-2026-39401?
No fix has been published for CVE-2026-39401 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-39401 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39401 exists.
Other vulnerabilities in jhuckaby Cronicle
Sources
Also known as GHSA-5j3v-cq96-xw6v.