Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with "create_events" and "run_events" privileges can inject top-level "uid" and "gid" fields through "/api/app/create_event" or "/api/app/update_event". In "lib/api.js", "requireValidEventData" uses "validateOptionalParams" as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In "lib/job.js", "launchJob" copies the whole event into the job, and a plugin "uid" overrides the event "uid" only when the plugin defines one. The default "shellplug" and "urlplug" plugins do not define a "uid", so the event-controlled identity survives into child-process launch. On a root-daemon installation, this lets a low-privileged user run jobs as arbitrary users, including root, bypassing the otherwise administrator-only run-as-user control. This API-side event injection is distinct from the job-output "uid"/"gid" injection addressed by CVE-2026-39401. This issue is fixed in version 0.9.121.