CVE-2026-57852: Grav CMS Auth Bypass Vulnerability

CVE-2026-57852 Overview

CVE-2026-57852 is an authentication bypass vulnerability in the Grav CMS scheduler-webhook plugin. The flaw stems from a short-circuit logic error in the webhook token validation routine. Unauthenticated remote attackers can send a single POST request to the scheduler webhook endpoint and trigger any configured scheduled job. Execution occurs under the web server process user, meaning operator-defined commands run without any credential check. The weakness is classified under [CWE-303: Incorrect Implementation of Authentication Algorithm].

Critical Impact
Unauthenticated attackers can invoke arbitrary operator-configured scheduled jobs on affected Grav CMS instances, resulting in command execution under the web server account.

Affected Products

Grav CMS with the scheduler-webhook plugin installed
Grav CMS instances exposing the scheduler webhook endpoint to the network
Deployments where operators have configured scheduled jobs invoked through the webhook

Discovery Timeline

2026-07-20 - CVE-2026-57852 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-57852

Vulnerability Analysis

The scheduler-webhook plugin exposes an HTTP endpoint that executes scheduled jobs when a valid token is presented. The token check contains a logic flaw that short-circuits when a null or empty value is compared, allowing the validation to succeed without a legitimate secret. An attacker who reaches the endpoint over the network can submit an unauthenticated POST request and cause the scheduler to run all configured jobs or a specific job by name. Because jobs execute in the context of the web server user, any operator-defined command, script, or maintenance task becomes reachable through the network path. The impact depends on what jobs administrators have configured, ranging from cache flushes to backup routines and shell commands.

Root Cause

The root cause is an incorrect authentication implementation [CWE-303] in the plugin's token comparison. The code path treats a missing or null-equivalent submitted token as a match, bypassing the intended shared-secret verification. The advisory titled "Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler-Webhook Token Check" from VulnCheck describes the class of flaw. See the GitHub Security Advisory GHSA-xwv3-2mv2-w33x for technical detail.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted POST request to the scheduler webhook route without a valid token. The server executes the configured job list or a targeted job identifier supplied in the request. Repeated invocations can cause resource abuse, unintended state changes, or execution of shell commands defined by the operator. The VulnCheck advisory provides additional context on the exploitation path.

No verified proof-of-concept code is available. Readers should consult the Grav repository and the linked advisories for implementation details.

Detection Methods for CVE-2026-57852

Indicators of Compromise

Unauthenticated POST requests to the Grav scheduler webhook endpoint, particularly those lacking or containing empty token parameters
Web server access logs showing scheduler job execution triggered outside expected administrative source addresses or schedules
Unexpected child processes spawned by the web server user corresponding to scheduled job commands
Log entries from the scheduler-webhook plugin indicating job triggers without a preceding authenticated session

Detection Strategies

Alert on HTTP POST requests to the webhook route that succeed with HTTP 200 while carrying no token header or query parameter
Correlate scheduled job execution timestamps in Grav logs against expected cron windows to surface out-of-band invocations
Baseline the process tree of the web server user and flag deviations that match configured Grav scheduled job commands

Monitoring Recommendations

Enable verbose access logging on the Grav web server and forward logs to a centralized analytics platform for retention and query
Monitor outbound network activity from the web server user, since exploited jobs may perform remote calls
Track file modifications in Grav content and configuration directories that could indicate abuse of scheduled maintenance jobs

How to Mitigate CVE-2026-57852

Immediate Actions Required

Inventory Grav CMS deployments and identify installations that have the scheduler-webhook plugin enabled
Restrict network reachability of the scheduler webhook endpoint to trusted administrative source addresses only
Review currently configured scheduled jobs and disable any that execute shell commands or sensitive operations until patched
Rotate any secrets or credentials referenced by scheduled jobs after confirming no unauthorized invocations occurred

Patch Information

Refer to the GitHub Security Advisory GHSA-xwv3-2mv2-w33x for the fixed plugin version and upgrade instructions. Apply the vendor-supplied update to the scheduler-webhook plugin as soon as it is available in the target environment. Verify the fix by confirming that unauthenticated POST requests to the webhook endpoint are rejected.

Workarounds

Disable the scheduler-webhook plugin if webhook-triggered scheduling is not required
Place the webhook endpoint behind an authenticated reverse proxy or IP allowlist enforced at the web server or firewall
Replace webhook-driven scheduling with a local cron invocation of the Grav scheduler where feasible

bash

# Example nginx location block restricting the scheduler webhook to trusted IPs
location /scheduler-webhook {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://grav_backend;
}