VulnSocial

CVE-2026-39401Disclosure(cronicle / cronicle)

LOWCVSS 5.4 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch cronicle cronicle systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.

cronicle CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cronicle

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
cronicle
Products
cronicle

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-04-08: 2Patch / Workaround · 2026-04-08: 1Technical Details · 2026-04-08: 204-08
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets3 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-39401 Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSO… https://www.cve.org/CVERecord?id=CVE-2026-39401

    Post summary

    The text refers to CVE‑2026‑39401, explaining that before version 0.9.111, Cronicle child processes could include an update_event key, indicating a vulnerability, and points to a patched version. No PoC, exploit, or active exploitation claims are present.

    00010169
    57.0K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-39401 Unauthorized Event Property Modification in Cronicle Before 0.9.1... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39401 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    A brief alert is posted announcing CVE-2026-39401, identifying it as an unauthorized event property modification in Cronicle prior to version 0.9.1, with links to vulnerability details and subscription options.

    0000057
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcroniclecronicle---

Explore more

Back to dashboardcronicle CVEscronicle vulnerabilities