CVE-2026-57852

The record

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.

Affected packages

Related vulnerabilities

• CVE-2026-84296 Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software… CWE-303
• CVE-2026-86589 Incorrect implementation of authentication algorithm vulnerability in Apache Answer. CWE-303
• CVE-2026-83906 Incorrect implementation of authentication algorithm in Windows Shell allows an… CWE-303
• CVE-2026-9854 A vulnerability exists in SYS600 RBAC mechanism where users having access to the… CWE-303
• CVE-2026-9853 A vulnerability exists in SYS600 which allows any user authenticated to the operating… CWE-303
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-303
• CVE-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in… CWE-303
• CVE-2026-11430 Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook… CWE-303