CVE-2026-58255

{
  "etk_id": "ETK-2026-2805",
  "cve_id": "CVE-2026-58255",
  "display_id": "CVE-2026-58255",
  "ghsa_id": "GHSA-9xpg-9w3g-mpwj",
  "euvd_id": "EUVD-2026-111408",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Privilege escalation through event identity injection in Cronicle",
  "summary": "Cronicle before 0.9.121 accepts injected user and group identity fields in event creation or update requests. A non-administrator user or scoped API key with permission to create and run events may cause jobs to execute as another user, including root, when the Cronicle daemon runs as root.",
  "mitigation": "Upgrade Cronicle to version 0.9.121 or later. Until upgraded, restrict create-events and run-events privileges to trusted users and API keys, and avoid running the Cronicle daemon as root.",
  "vendor": "jhuckaby",
  "product": "Cronicle",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.9.120"
      ],
      "ecosystem": "github",
      "fixed_versions": [
        "0.9.121"
      ],
      "package_name": "cronicle",
      "purl": null
    }
  ],
  "cwes": [
    269
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.62331595,
  "t0_at": "2026-10-27T22:30:09.563000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T22:30:09.563000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T22:30:09.563000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58255"
    }
  }
}