CVE-2026-34072

Katalog CVE

CVSS 9.8 · Critical EPSS 0,91%

Kerentanan Improper Authentication pada fccview cronmaster. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.

Rincian

Terbit di NVD

1 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-306: Missing Authentication for Critical Function
CWE-693: Protection Mechanism Failure

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6 advisory vendor
• https://github.com/fccview/cronmaster/releases/tag/2.2.0 release notes