Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

{
                    "vendor": "jhuckaby",
                    "product": "Cronicle",
                    "versions": [
                        {
                            "version": "< 0.9.121",
                            "status": "affected"
                        }
                    ]
                }