CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.

• CWE-862

• https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6vExploit, Vendor Advisory
• https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6vExploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jul 20, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39396OpenBao is an open source identity-based secrets management …6.5
• CVE-2026-39397@delmaredigital/payload-puck is a PayloadCMS plugin for inte…9.8
• CVE-2026-39398Rejected reason: The affected product and advisory are not p…
• CVE-2026-39399NuGet Gallery is a package repository that powers nuget.org.…9.6
• CVE-2026-3940Insufficient policy enforcement in DevTools in Google Chrome…5.3
• CVE-2026-39400Cronicle is a multi-server task scheduler and runner, with a…6.1
• CVE-2026-39402lxc is a Linux container runtime. In the setuid helper lxc-u…6.5
• CVE-2026-39405Frappe Learning Management System (LMS) is a learning system…9.4
• CVE-2026-39406@hono/node-server allows running the Hono application on Nod…5.3
• CVE-2026-39407Hono is a Web application framework that provides support fo…5.3
• CVE-2026-39408Hono is a Web application framework that provides support fo…7.5
• CVE-2026-39409Hono is a Web application framework that provides support fo…5.3