Search: CVE-2026-39401

CVE-2026-39401 is a medium severity vulnerability in jhuckaby Cronicle versions prior to 0.9.111. It involves missing authorization checks when jb child processes include an update_event key in their JSON output. This allows a low-privilege user who can create and run events to modify any event property, such as webhook URLs and notification emails. The vulnerability is fixed in version 0.9.111.