Does Your Cronicle Scheduler Have an Unpatched Account Takeover Flaw?

Cronicle, a multi-server task scheduler with a web-based interface, contains a critical stored cross-site scripting vulnerability that enables full administrator account takeover. According to the NVD record for CVE-2026-55562, this flaw affects all releases prior to version 0.9.119. The vulnerability allows attackers to plant executable code that triggers when system administrators access specific log pages.

The technical root of the issue lies in how the application handles user data within the Activity Log interface. In the file htdocs/js/pages/admin/Activity.js, the system concatenates the value of item.user.full_name directly into HTML output. This insertion occurs without applying necessary encoding safeguards, specifically failing to use encode_entities. As a result, any script tags embedded in that name field are rendered and executed by the browser.

Bypassing Input Filters

The vulnerability persists because the built-in input filtering mechanism can be circumvented with specific formatting tricks. The bundled pixl-server-user input filter relies on a regular expression that fails to match line breaks. An attacker can include a tag containing a newline character to bypass this validation check. This allows malicious payloads to pass through the filter and be stored in the database as part of the user profile.

Attack Vectors and Impact

Access requirements for exploitation vary based on server configuration. An authenticated non-administrator user can update their own name through the /api/user/update endpoint using a valid session and current password. If the free_accounts feature is enabled, the barrier is even lower. In that scenario, an anonymous attacker can plant the malicious name during the self-registration process, requiring no prior credentials to initiate the attack.

Next steps

The vendor has addressed this vulnerability in version 0.9.119. Organizations running earlier versions should verify their current release and upgrade immediately to apply the fix. Until the update is installed, the risk remains active for any environment where the Activity Log is accessible to administrators. No other patches or workarounds have been confirmed by the source material.

Signals worth monitoring

Teams usually detect stored cross-site scripting by observing unexpected JavaScript execution in administrative interfaces. Security operations centers should check whether web application firewalls flagged encoded script attempts in user profile updates. Look for anomalies where non-admin users modify their display names shortly before an admin accesses the Activity Log. Containment often involves temporarily disabling the self-registration feature or restricting API access to user profile updates to prevent further payload planting.

What to do and how to stay safe: Cronicle

• Verify your current Cronicle version and upgrade to 0.9.119 or later as soon as possible.
• Review Activity Logs for any unusual script executions or unexpected administrative actions.
• Consider disabling the free_accounts feature if you do not require anonymous self-registration.
• Monitor web server logs for requests to the /api/user/update endpoint from non-administrative accounts.

Step-by-step guide: Emergency Patching Checklist for Critical System Fixes

General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Cronicle versions are affected by CVE-2026-55562?

All versions prior to 0.9.119 are vulnerable to this stored cross-site scripting flaw.

Can an anonymous attacker exploit this vulnerability?

Yes, if the free_accounts feature is enabled, anonymous users can inject the payload during registration.

Is there a patch available for this issue?

Yes, the issue is fixed in version 0.9.119 according to the NVD record.