CVE-2026-11430
Received Received - Intake

Authentication Bypass in Grav CMS Scheduler-Webhook Plugin

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: VulnCheck

Description
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-11430
EUVD
EUVD-2026-54601

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
grav cms scheduler-webhook
getgrav grav 2.0.9
getgrav grav-plugin-scheduler-webhook 1.1.3
getgrav grav 2.0.8
getgrav grav-plugin-scheduler-webhook 1.1.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-303 The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-11430 is an authentication bypass in Grav CMS's scheduler-webhook plugin. When the webhook feature is enabled but no token is configured, a conditional check skips token validation. This allows unauthenticated remote attackers to trigger scheduled jobs by sending a POST request to /scheduler/webhook. The attacker controls which job runs but cannot execute arbitrary commands unless a job is configured to shell out.

Detection Guidance

Check if the scheduler-webhook plugin is installed and enabled by inspecting Grav CMS plugins. Verify if the webhook endpoint is accessible without authentication by sending a POST request to /scheduler/webhook. Look for unauthorized job triggers in server logs.

Impact Analysis

If exploited, this vulnerability allows attackers to trigger scheduled jobs on your Grav CMS server without authentication. If any configured job runs shell commands, attackers could execute arbitrary code with the web server's privileges. This could lead to data theft, server compromise, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access and execution of commands, potentially violating GDPR's data protection requirements or HIPAA's security rules. It may result in data breaches, unauthorized modifications, or service disruptions, all of which are compliance violations requiring breach notifications and corrective actions.

Mitigation Strategies

Update Grav CMS to version 2.0.9 or later and the scheduler-webhook plugin to version 1.1.3 or later. Ensure a webhook token is configured and set scheduler.modern.webhook.enabled to false if not needed. Disable the webhook feature if unused.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11430. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart