CVE-2026-58255 — Cronicle: non-admin uid/gid injection in create_event/update_event enables running as an arbitrary user, including root

According to the CERT title, a Cronicle vulnerability allows a non-admin to inject uid/gid values into create_event/update_event and run actions as an arbitrary user, including root.