TI-2026-41658 Aliases CVE-2026-57852 GHSA-4p4x-7xpg-55gw

Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

LOW 29CWE-303Published 2026-07-20 · Updated 2026-07-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00686 52nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Trilby Media	Grav CMS scheduler-webhook plugin	up to 1.1.3; up to 2.0.8	—	No fix listed	CNA

Grav CMS scheduler-webhook plugin VendorTrilby Media Affected up to 1.1.3; up to 2.0.8 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-57852
2026-10-03 Alias added: GHSA-4p4x-7xpg-55gw

References

Advisory 1

GitHub Security Advisory (GHSA-xwv3-2mv2-w33x)

Other 1

Product

TI-2026-51057 Grav through 2.0.11 Authentication Bypass via Flex Objects CVSS 4.0HIGH 8.7
TI-2026-71134 OS command injection in Grav Git Sync via commit author fields CVSS 4.0HIGH 8.7
TI-2026-09863 Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences