Cronicle is a multi‑server task scheduler with a web‑based UI. Prior to version 0.9.111 child processes can emit JSON that contains an update_event key. The server applies this key directly to the parent event’s stored configuration without checking the user’s authorization. An attacker who can create and run events therefore gains the ability to modify any event property, including webhook URLs and notification emails, which is a form of privilege escalation. The weakness is classed as CWE‑862, indicating improper authorization.

All installations of jhuckaby Cronicle older than 0.9.111 are affected. The vulnerability requires that the user have permission to create or run events on the server, meaning users with the ability to schedule jobs can exploit it.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting no widely known exploitation yet. The attack vector is inferred to be the ability to schedule and execute jobs locally on the server, with the attacker injecting the update_event field to alter event behavior.