QSearchQSearch

CVE-2026-34072

8.3 HIGH

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs

Published: 2026-04-01 · Last updated: 2026-06-02

Severity and scoring

CVSS
8.3 HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE
CWE-287, CWE-306, CWE-693

Affected products

VendorProduct
fccviewcronmaster

Description

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-53853 — OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowe... (8.3 HIGH)
  • CVE-2026-53845 — OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispatch path skip before-... (4.3 MEDIUM)
  • CVE-2026-48780 — Forem is open source software for building communities (8.2 HIGH)
  • CVE-2026-0647 — An improper authentication security issue exists within the 1794-AENTR adapter's embedded web server
  • CVE-2026-12316 — Mitigation bypass in the DOM: Security component (9.1 CRITICAL)