PT-2026-61740 · Grav Cms · Scheduler-Webhook

Saidakbarxon Maxsudxonov · CVE-2026-57852 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin (affected versions not specified)

Description An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote attackers to trigger configured scheduled jobs by sending a POST request to the scheduler webhook endpoint. Attackers can execute all configured jobs or target a specific one, leading to the unintended execution of operator-defined commands under the privileges of the web server process user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-303

Related Identifiers

CVE-2026-57852

Affected Products

Scheduler-Webhook

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-57852 · Security Note
• https://github.com/getgrav/grav/security/advisories/GHSA-xwv3-2mv2-w33x · Note
• https://github.com/getgrav/grav · Note
• https://twitter.com/VulmonFeeds/status/2079437651736764799 · Twitter Post
• https://vulncheck.com/advisories/authentication-bypass-via-null-short-circuit-in-grav-cms-scheduler-webhook-token-check · Note
• https://twitter.com/CVEnew/status/2079350882911551571 · Twitter Post
• https://twitter.com/infoflowcloud/status/2079352210312323153 · Twitter Post