PatchTheCVECVE-2026-58255: Cronicle is a multi-server task scheduler and runner, with a web based front-end UI
CVE-2026-58255 is a high-severity flaw (CVSS 8.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected
Why this priority
- High severity
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-10-27 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: CVE-2026-58255 2026-10-27
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-58255?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-58255 being exploited?
CVE-2026-58255 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-58255 affect?
CVE-2026-58255 affects affected software. Severity is high (CVSS 8.8). Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields t
How urgent is CVE-2026-58255?
Priority 31/100. High severity