CVE-2026-11430 in Grav
Summary
by MITRE • 08/07/2026
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in Grav CMS's scheduler-webhook plugin represents a critical authentication bypass that exploits a logical flaw in the webhook token validation mechanism. This issue stems from a compound conditional statement that fails to properly validate authentication when no webhookToken is configured, creating an unintended access path for unauthenticated attackers. The flaw exists specifically within the webhook endpoint at POST /scheduler/webhook where the system performs insufficient validation checks, allowing remote exploitation without proper authentication credentials.
The technical implementation of this vulnerability demonstrates a classic short-circuit evaluation error in conditional logic where multiple boolean expressions are combined without proper safeguarding. When the scheduler-webhook plugin is enabled but no webhookToken is configured, the system's validation routine executes a series of conditional checks that, due to their logical structure, skip the token verification step entirely. This creates an authentication bypass scenario where any remote attacker capable of reaching the specific endpoint can trigger scheduled operations without providing valid credentials.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables attackers to manipulate the timing and execution of existing scheduled tasks within the Grav CMS environment. While the attack vector does not provide direct command execution capabilities or payload control, it allows adversaries to influence when and which pre-configured jobs execute by leveraging the ?job= parameter in requests. This means that if an operator has configured jobs that perform system-level operations such as shell commands or file manipulations, attackers can orchestrate these operations at their discretion. The vulnerability operates under the principle of timing control rather than payload control, making it particularly dangerous when operators have configured malicious or destructive scheduled tasks.
The security implications of this vulnerability align with CWE-287 which addresses improper authentication mechanisms and can be mapped to ATT&CK technique T1059 for execution through command and scripting interpreters. The attack requires specific preconditions including the installation of the scheduler-webhook plugin, enabling the webhook functionality, and leaving the webhookToken unconfigured. This makes it a non-default issue that only affects installations with specific configurations, but once present, provides significant operational control to attackers who can leverage existing scheduled operations rather than injecting new code.
Mitigation strategies for this vulnerability require immediate attention from administrators who have installed the scheduler-webhook plugin. The primary recommendation involves configuring a proper webhookToken value when enabling the webhook functionality, ensuring that all authentication checks are properly enforced. Additionally, network-level restrictions should be implemented to limit access to the POST /scheduler/webhook endpoint to trusted IP addresses only, reducing the attack surface for remote exploitation. System administrators should also conduct thorough audits of their scheduled tasks to ensure no malicious operations have been configured by unauthorized parties, particularly focusing on jobs that execute shell commands or perform sensitive system operations. Regular security assessments and monitoring of webhook access logs can help detect unauthorized usage patterns and provide early warning of potential exploitation attempts.