CVE-2026-11430: Grav CMS Auth Bypass Vulnerability

CVE-2026-11430 Overview

CVE-2026-11430 is an authentication bypass vulnerability in the Grav CMS scheduler-webhook plugin. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation entirely. An unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger any of the operator's already-configured scheduled jobs by sending a single HTTP request. The attacker selects which job to run via the ?job= parameter but does not control what the job does. This is not a default-install issue: the separate scheduler-webhook GPM plugin must be installed and scheduler.modern.webhook.enabled must be set to true. The weakness is classified under CWE-303: Incorrect Implementation of Authentication Algorithm.

Critical Impact
Unauthenticated remote attackers can trigger arbitrary pre-configured scheduled jobs, potentially leading to code execution when operators have configured jobs that invoke shell commands.

Affected Products

Grav CMS with the scheduler-webhook GPM plugin installed
Grav CMS versions prior to 2.0.9
Deployments with scheduler.modern.webhook.enabled=true and no webhookToken configured

Discovery Timeline

2026-08-07 - CVE-2026-11430 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-11430

Vulnerability Analysis

The scheduler-webhook plugin exposes an HTTP endpoint at POST /scheduler/webhook that is intended to trigger scheduled jobs after validating a shared secret token. The token check uses a compound conditional that evaluates both whether a webhookToken is configured and whether the supplied token matches. When no webhookToken is set, the left operand short-circuits and the token comparison is skipped, allowing the request to proceed unauthenticated.

The exploitation primitive is triggering existing jobs, not attacker-chosen command execution. The attacker controls the timing and selects which configured job runs via the ?job= query parameter. Code execution follows only when operators have configured a job that shells out. A stock Grav or Grav-Admin installation without the plugin exposes nothing here.

Root Cause

The root cause is an incorrect authentication algorithm implementation ([CWE-303]) in the webhook handler. The compound boolean expression treats an unconfigured token as "no check required" instead of a fail-closed configuration error. Missing security state should reject the request rather than permit it.

Attack Vector

An unauthenticated remote attacker sends a single HTTP POST request to /scheduler/webhook?job=<jobId> over the network. No user interaction, credentials, or prior access to the Grav instance is required. See the VulnCheck Advisory on Grav CMS for additional exploitation context.

php

// Security patch in system/defines.php
// Source: https://github.com/getgrav/grav/commit/694f1dae06d9061bbf0669c4291e3b206f998d71
 define("GRAV", true);
-define("GRAV_VERSION", "2.0.8");
+define("GRAV_VERSION", "2.0.9");
 define("GRAV_SCHEMA", "1.8.0_2026-06-09_0");
 define("GRAV_TESTING", false);

The patch bumps the Grav version to 2.0.9, which ships the corrected webhook token validation logic. See the GitHub Commit 694f1da for the full change set.

Detection Methods for CVE-2026-11430

Indicators of Compromise

Unexpected POST requests to /scheduler/webhook in web server access logs, particularly with a ?job= parameter and no authorization header or token.
Scheduled jobs executing outside their normal cron cadence or at anomalous times.
HTTP 200 responses to /scheduler/webhook requests originating from external IP addresses.

Detection Strategies

Audit the Grav configuration for scheduler.modern.webhook.enabled=true combined with a missing or empty webhookToken value.
Correlate webhook endpoint hits against scheduled job execution logs to identify externally triggered runs.
Enumerate installations that have the scheduler-webhook GPM plugin present and flag those exposing the endpoint to untrusted networks.

Monitoring Recommendations

Alert on any HTTP request path matching /scheduler/webhook from non-allowlisted source addresses.
Monitor scheduled job process trees for shell invocations that spawn immediately after a webhook request.
Track configuration file changes to scheduler.yaml and related Grav plugin settings.

How to Mitigate CVE-2026-11430

Immediate Actions Required

Upgrade Grav CMS to version 2.0.9 or later, which corrects the token validation logic per GitHub Commit 694f1da.
Configure a strong, random webhookToken value on any installation where scheduler.modern.webhook.enabled is true.
Review all currently configured scheduled jobs for commands that shell out and validate their necessity.

Patch Information

The fix is included in Grav CMS 2.0.9. Refer to the GitHub Security Advisory GHSA-xwv3-2mv2-w33x for the official maintainer guidance and to the GitHub Repository for Grav for release artifacts.

Workarounds

Disable the webhook feature by setting scheduler.modern.webhook.enabled to false until the upgrade is applied.
Uninstall the scheduler-webhook GPM plugin if it is not required for operations.
Restrict access to /scheduler/webhook at the reverse proxy or WAF layer to trusted source IP ranges only.

bash

# Configuration example: enforce webhook token in user/config/scheduler.yaml
modern:
  webhook:
    enabled: true
    token: 'REPLACE_WITH_A_LONG_RANDOM_SECRET'