CVE-2026-11430: Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-07 · updated 2026-08-31
Weakness: CWE-303

Description

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.

Affected products

Trilby Media getgrav/grav: before 2.0.9 — fixed in 2.0.9
Trilby Media grav-plugin-scheduler-webhook: before 1.1.3 — fixed in 1.1.3

How to fix

Upgrade to a fixed version: Trilby Media getgrav/grav 2.0.9; Trilby Media grav-plugin-scheduler-webhook 1.1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-11430 or the next vulnerability affects your stack