CVE-2026-11430

The record

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.

Affected packages

Related vulnerabilities

• CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the… CWE-303
• CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating… CWE-303
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-303
• CVE-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CWE-303
• CVE-2026-10050 In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to… CWE-303
• CVE-2026-59309 VMware vCenter contains an authentication bypass vulnerability in the VMware Directory… CWE-303
• CVE-2026-50360 Incorrect implementation of authentication algorithm in Windows SMB Server allows an… CWE-303
• CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme… CWE-303