EUVD-2026-54601
GHSA-3m6r-m23g-m2w9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint (AV:N/PR:N); limited C/I/A because the primitive is job-triggering, not direct code injection or data exfiltration.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.
AnalysisAI
Unauthenticated remote attackers can trigger operator-configured scheduled jobs in Grav CMS when the scheduler-webhook plugin is installed and misconfigured, due to a compound-conditional short-circuit (CWE-303) that skips token validation entirely when no webhookToken is set. The primitive is job-triggering rather than attacker-controlled command injection: RCE is only achievable when an administrator has separately configured a scheduled job that shells out, a condition the attacker cannot influence. No public exploit has been identified at time of analysis, and the vendor-released fix is available in Grav v2.0.9.
Technical ContextAI
The flaw resides in the optional scheduler-webhook GPM plugin for Grav CMS (PHP flat-file CMS, https://github.com/getgrav/grav), specifically in its webhook token validation handler for POST /scheduler/webhook. CWE-303 (Incorrect Implementation of Authentication Algorithm) describes the root cause precisely: the guard uses a compound conditional that evaluates to true - skipping validation entirely - when the webhookToken configuration value is null or absent, rather than defaulting to deny. The ?job= query parameter selects which operator-configured scheduled job to invoke. The vulnerability is entirely absent in default Grav or Grav-Admin installations; it is introduced only by installing the separate scheduler-webhook GPM plugin and explicitly enabling it with scheduler.modern.webhook.enabled: true while omitting a token. The commit diff at 694f1dae confirms the fix is a fail-closed change to the token check logic, shipped in Grav v2.0.9.
RemediationAI
The primary remediation is upgrading Grav CMS to v2.0.9 or later, which makes the scheduler webhook fail closed when no token is configured, as documented in GHSA-xwv3-2mv2-w33x and the upstream commit at https://github.com/getgrav/grav/commit/694f1dae06d9061bbf0669c4291e3b206f998d71. If immediate upgrade is not feasible, operators can close the bypass by setting a strong, randomly-generated webhookToken in the scheduler configuration - this restores the token check to functional status and preserves webhook functionality with no side effects. Alternatively, setting scheduler.modern.webhook.enabled to false disables the feature entirely, eliminating the attack surface at the cost of losing webhook-triggered scheduling. A third option is blocking external access to POST /scheduler/webhook at the web server or reverse-proxy layer; this prevents exploitation from untrusted networks but does not fix the underlying code defect. The upgrade to v2.0.9 is strongly preferred as the only definitive fix.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today