CVE-2026-39401

CVE-2026-39401 affects Cronicle, a multi-server task scheduler and runner with web-based UI, in versions prior to 0.9.111. The vulnerability allows low-privilege users who can create and run events to modify any event property without authorization by injecting an update_event key into job child process JSON output. This enables attackers to alter critical event configurations including webhook URLs and notification emails. The vulnerability presents a medium severity risk with a CVSS score of 5.4. It requires network access and low-level privileges but has low attack complexity, with an unauthenticated network vector. The impact is limited to partial confidentiality and integrity compromise without affecting availability, as indicated by the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. There is no evidence of active exploitation at this time. The CVE does not appear on the KEV catalog, and the EPSS score of 0.0003 indicates minimal probability of exploitation. Community attention remains low, with the vulnerability classified as inactive on hot lists. Organizations should prioritize patching to version 0.9.111 as part of routine maintenance rather than emergency response.