CVE-2026-11430

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin (affected versions not specified)

Description An authentication bypass exists in the webhook token check of the scheduler-webhook plugin. When the webhook feature is enabled but no webhookToken is configured, the system skips token validation. This allows an unauthenticated remote attacker to trigger previously configured scheduled jobs by sending a request to the 'POST /scheduler/webhook' endpoint. The attacker can determine which job runs using the job parameter, although they cannot control the job's payload. Remote code execution is only possible if the operator has configured a job that executes shell commands. This issue requires the scheduler-webhook plugin to be installed and the scheduler.modern.webhook.enabled setting to be set to true.

Recommendations Configure a webhookToken to ensure token validation is performed. Set scheduler.modern.webhook.enabled to false if the webhook feature is not required. As a temporary workaround, restrict access to the 'POST /scheduler/webhook' endpoint.