CVE-2026-39401: Cronicle Privilege Escalation - 0.9.0 < 0.9.111

CVE-2026-39401 in Cronicle allows low-privilege users to modify any event's configuration, including webhook URLs and notification emails. Prior to version 0.9.111, the server directly applies updates to the parent event's stored configuration without authorization checks when a 'jb' child process includes an 'update_event' key in its JSON output. An attacker could exploit this to redirect notifications, intercept data, or even execute malicious code through compromised webhooks. The severity stems from the potential to compromise the integrity and confidentiality of data processed by Cronicle, and potentially the system's availability.

1. Reserved2026-04-06
2. Published2026-04-07
3. Modified2026-04-08
4. EPSS updated2026-04-15

The fix for this vulnerability is to upgrade Cronicle to version 0.9.111 or later. This version introduces an authorization check to prevent unauthorized modification of event configurations. It is strongly recommended to apply this update as soon as possible to mitigate the risk of exploitation. Additionally, review existing event configurations to ensure they haven't been maliciously modified prior to the update. Monitoring Cronicle logs for suspicious activity can also help detect and respond to potential attacks. Implementing the principle of least privilege for Cronicle users is a general security best practice.