CVE-2026-34072

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/fccview/cronmaster/releases/tag/2.2.0	Release Notes
https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fccview:cronmaster:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) CrnMaster (cronmaster) es una interfaz de usuario (UI) para la gestión de Cronjobs con sintaxis legible para humanos, registro en vivo e historial de registros para los cronjobs. Antes de la versión 2.2.0, una omisión de autenticación en el middleware permite que las solicitudes no autenticadas con una cookie de sesión inválida sean tratadas como autenticadas cuando la recuperación de validación de sesión del middleware falla. Esto puede resultar en acceso no autorizado a páginas protegidas y ejecución no autorizada de Acciones de Servidor privilegiadas de Next.js. Este problema ha sido parcheado en la versión 2.2.0.

Information

Published : 2026-04-01 18:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-34072

Mitre link : CVE-2026-34072

CVE.ORG link : CVE-2026-34072

JSON object : View

Products Affected

fccview

cronmaster

CWE

CWE-287

Improper Authentication

CWE-306

Missing Authentication for Critical Function

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-34072", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34072", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T17:45:02.731849Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "fccview", "product": "cronmaster", "versions": [{"status": "affected", "version": "< 2.2.0"}]}]}], "published": "2026-04-01T18:16:29.340", "references": [{"url": "https://github.com/fccview/cronmaster/releases/tag/2.2.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware\u2019s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0."}, {"lang": "es", "value": "CrnMaster (cronmaster) es una interfaz de usuario (UI) para la gesti\u00f3n de Cronjobs con sintaxis legible para humanos, registro en vivo e historial de registros para los cronjobs. Antes de la versi\u00f3n 2.2.0, una omisi\u00f3n de autenticaci\u00f3n en el middleware permite que las solicitudes no autenticadas con una cookie de sesi\u00f3n inv\u00e1lida sean tratadas como autenticadas cuando la recuperaci\u00f3n de validaci\u00f3n de sesi\u00f3n del middleware falla. Esto puede resultar en acceso no autorizado a p\u00e1ginas protegidas y ejecuci\u00f3n no autorizada de Acciones de Servidor privilegiadas de Next.js. Este problema ha sido parcheado en la versi\u00f3n 2.2.0."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fccview:cronmaster:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40386133-F58F-4421-A855-B92B5EE863A7", "versionEndExcluding": "2.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}