CVE-2026-34072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34072", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T16:21:40.867Z", "datePublished": "2026-04-01T16:51:33.306Z", "dateUpdated": "2026-04-01T17:45:11.248Z"}, "containers": {"cna": {"title": "cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6"}, {"name": "https://github.com/fccview/cronmaster/releases/tag/2.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/fccview/cronmaster/releases/tag/2.2.0"}], "affected": [{"vendor": "fccview", "product": "cronmaster", "versions": [{"version": "< 2.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T16:51:33.306Z"}, "descriptions": [{"lang": "en", "value": "Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware\u2019s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0."}], "source": {"advisory": "GHSA-9whh-mffv-xvh6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T17:45:02.731849Z", "id": "CVE-2026-34072", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:45:11.248Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34072", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T17:45:02.731849Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T17:45:06.888Z"}}], "cna": {"title": "cronmaster: Middleware authentication bypass enabling unauthorized page access and server-action execution", "source": {"advisory": "GHSA-9whh-mffv-xvh6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fccview", "product": "cronmaster", "versions": [{"status": "affected", "version": "< 2.2.0"}]}], "references": [{"url": "https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6", "name": "https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fccview/cronmaster/releases/tag/2.2.0", "name": "https://github.com/fccview/cronmaster/releases/tag/2.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware\u2019s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-01T16:51:33.306Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34072", "state": "PUBLISHED", "dateUpdated": "2026-04-01T17:45:11.248Z", "dateReserved": "2026-03-25T16:21:40.867Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-01T16:51:33.306Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cronmaster", "vendor": "fccview", "versions": [{"status": "affected", "version": "< 2.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fccview:cronmaster:*:*:*:*:*:*:*:*", "matchCriteriaId": "40386133-F58F-4421-A855-B92B5EE863A7", "versionEndExcluding": "2.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs. Prior to version 2.2.0, an authentication bypass in middleware allows unauthenticated requests with an invalid session cookie to be treated as authenticated when the middleware\u2019s session-validation fetch fails. This can result in unauthorized access to protected pages and unauthorized execution of privileged Next.js Server Actions. This issue has been patched in version 2.2.0."}, {"lang": "es", "value": "CrnMaster (cronmaster) es una interfaz de usuario (UI) para la gesti\u00f3n de Cronjobs con sintaxis legible para humanos, registro en vivo e historial de registros para los cronjobs. Antes de la versi\u00f3n 2.2.0, una omisi\u00f3n de autenticaci\u00f3n en el middleware permite que las solicitudes no autenticadas con una cookie de sesi\u00f3n inv\u00e1lida sean tratadas como autenticadas cuando la recuperaci\u00f3n de validaci\u00f3n de sesi\u00f3n del middleware falla. Esto puede resultar en acceso no autorizado a p\u00e1ginas protegidas y ejecuci\u00f3n no autorizada de Acciones de Servidor privilegiadas de Next.js. Este problema ha sido parcheado en la versi\u00f3n 2.2.0."}], "id": "CVE-2026-34072", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34072", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T17:45:02.731849Z", "version": "2.0.3"}}]}, "published": "2026-04-01T18:16:29.340", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/fccview/cronmaster/releases/tag/2.2.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/fccview/cronmaster/security/advisories/GHSA-9whh-mffv-xvh6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "cronmaster", "source": "cna", "vendor": "fccview"}, "product": "cronmaster", "vendor": "fccview"}], "analysis": {"en": {"generated_at": "2026-04-02T03:46:54.856028+00:00", "value": {"mitigation_remediation": ["Apply the latest cronmaster release (v2.2.0) or newer to eliminate the middleware flaw.", "Verify that no legacy Cronmaster versions remain in production and that the upgraded code is successfully deployed.", "If an upgrade cannot be performed immediately, enhance network or application\u2011level access controls to restrict unauthenticated traffic to protected pages.", "Enable comprehensive logging and actively monitor for anomalous authentication attempts or unauthorized server\u2011action invocations."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The issue affects the fccview Cronmaster application, specifically all releases before version 2.2.0. Any deployment using these older versions is susceptible until patched.", "description_and_impact": "A flaw in the middleware authentication checks of Cronmaster allows unauthenticated users to be treated as authenticated when an invalid session cookie results in a failed session\u2011validation fetch. As a consequence, attackers can view protected pages and trigger privileged Next.js Server Actions without proper credentials. The vulnerability stems from improper session handling (CWE\u2011287, CWE\u2011306, CWE\u2011693).", "risk_and_exploitability": "The CVSS v3 score of 8.3 indicates high severity, while no EPSS data is available and it is not listed in KEV. The likely attack vector is an unauthenticated HTTP request sent to any protected endpoint. If exploited, an attacker could obtain privileged access that may lead to further compromise. Given the lack of a hard\u2011coded exploitation method in the description, de\u2011risking requires patching the middleware rather than solely relying on defensive controls."}}}}, "created": "2026-04-02T07:48:16.157629+00:00", "updated": "2026-04-02T20:17:12.429739+00:00", "vendors": ["fccview", "fccview$PRODUCT$cronmaster"]}