Authentication Bypass in Grav CMS Scheduler Webhook Plugin

CVE-2026-11430

What is CVE-2026-11430?

The scheduler-webhook plugin in Grav CMS has a vulnerability that allows unauthenticated remote attackers to bypass webhook token validation under specific conditions. If the webhook feature is enabled without a configured webhookToken, the vulnerability can be exploited through a single POST request to the /scheduler/webhook endpoint, thus triggering pre-configured scheduled jobs. Although the attacker cannot execute arbitrary commands, they can influence which jobs run via the job parameter. This vulnerability necessitates that the scheduler-webhook GPM plugin be installed and the related configuration settings are modified, indicating that default installations do not expose this risk.

References