EUVD-2026-46123
GHSA-4p4x-7xpg-55gw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint requires non-default plugin and job configuration (AC:H); no credentials needed (PR:N); impact bounded to low C/I/A reflecting generic scheduled-job execution scope.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.
AnalysisAI
Unauthenticated triggering of all configured scheduled jobs in Grav CMS's scheduler-webhook plugin is possible due to a null short-circuit logic flaw in webhook token validation, allowing any network-reachable attacker to execute operator-defined commands under the web server process account via a single POST request. The affected component is the scheduler-webhook plugin for Grav CMS, a PHP flat-file CMS; the CVSS 4.0 vector (AC:H/AT:P) confirms exploitation requires the plugin to be installed with configured jobs and an exposed endpoint - not a default Grav deployment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Technical ContextAI
Grav CMS is a PHP-based flat-file content management system. The scheduler-webhook plugin extends Grav by exposing an HTTP endpoint that external callers can use to trigger Grav scheduler jobs, authenticated via a webhook token. The root cause is CWE-303 (Incorrect Implementation of Authentication Algorithm): a short-circuit logic flaw in the token validation routine - likely a null comparison or boolean short-circuit that evaluates to 'true' without a valid token being supplied - causes the authentication gate to be bypassed entirely. The NVD references point to the core Grav repository at github.com/getgrav/grav, with the scheduler-webhook plugin as the specific vulnerable surface. The CVSS 4.0 vector metric AT:P (attack requirements present) explicitly encodes the dependency on a specific non-default configuration: the plugin must be installed, configured with scheduled jobs, and the webhook endpoint must be network-reachable for exploitation to succeed.
RemediationAI
The primary remediation is to apply the fix documented in GitHub Security Advisory GHSA-xwv3-2mv2-w33x (https://github.com/getgrav/grav/security/advisories/GHSA-xwv3-2mv2-w33x) and the VulnCheck advisory (https://www.vulncheck.com/advisories/authentication-bypass-via-null-short-circuit-in-grav-cms-scheduler-webhook-token-check). An exact patched version number was not confirmed from the available data and must be verified via the advisory before upgrading. If immediate patching is not possible, the most effective compensating control is disabling the scheduler-webhook plugin entirely if webhook-triggered scheduling is not a required function - this eliminates the attack surface with no impact on other Grav features. Alternatively, restrict the webhook endpoint route to trusted IP addresses at the web server or perimeter firewall level; note this only reduces exposure and does not fix the underlying flaw, so any trusted host compromise would still allow exploitation.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today