CVE-2026-34072

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-34072

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34072.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-34072

Aliases

GHSA-9whh-mffv-xvh6

Published

2026-04-01T16:51:33.306Z

Modified

2026-07-15T01:49:09.791834584Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution

Details

Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware’s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0.

Database specific

{
    "cwe_ids": [
        "CWE-287",
        "CWE-306",
        "CWE-693"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34072.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/fccview/cronmaster

Affected ranges

Type

GIT

Repo

https://github.com/fccview/cronmaster

Events

Introduced

Fixed

70dd52805cb2d3391553bcbdd9c0752ce433215f

Database specific

{
    "cpe": "cpe:2.3:a:fccview:cronmaster:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.0"
        }
    ]
}

Affected versions

1.*

1.0.0

1.2.0

1.2.1

1.3.0

1.3.1

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

2.*

2.0.0

2.1.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34072.json"