CVE-2026-58255High· 8.8▾ TwilightCronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` field…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with create_events and run_events privileges can inject top-level uid and gid fields through /api/app/create_event or /api/app/update_event. In lib/api.js, requireValidEventData uses validateOptionalParams as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In lib/job.js, launchJob copies the whole event into the job, and a plugin uid overrides the event uid only when the plugin defines one. The default shellplug and urlplug plugins do not define a uid, so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output uid/gid injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.
Cronicle < 0.9.121Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55562Critical· 9.0Cronicle is a multi-server task scheduler and runner, with a web based front-end UI
CVE-2018-16497High· 7.8In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server
CVE-2021-20021Critical· 9.8A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2026-109381High· 7.2Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter
CVE-2026-110018High· 8.8aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute
CVE-2023-45581High· 7.9An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientE…