What is CVE-2026-11430?
The scheduler-webhook plugin in Grav CMS has an authentication bypass vulnerability in the webhook token validation. When the webhook feature is enabled but no webhookToken is configured, the token check logic short-circuits, allowing an unauthenticated remote attacker to send POST requests to the `/schedul` endpoint. Users should either properly configure a webhookToken or disable the plugin to mitigate the risk.
Azərbaycanca: Grav CMS-in scheduler-webhook plaginində vebhook token yoxlamasında autentifikasiyadan yan keçmə zəifliyi aşkarlanıb. Əgər webhook funksiyası aktiv olsa da, token konfiqurasiya edilməyibsə, doğrulama məntiqi səhv işləyir. Bu, uzaqdan autentifikasiya olunmamış hücumçuya `/schedul` endpointinə POST sorğusu göndərməyə imkan verə bilər; istifadəçilər problemi aradan qaldırmaq üçün token-i mütləq konfiqurasiya etməli və ya plagini deaktiv etməlidirlər.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
Under what conditions can CVE-2026-11430 be exploited in Grav CMS?
The vulnerability can be exploited when the webhook feature is enabled but no webhookToken is configured. In this case, the token check logic short-circuits, allowing an authentication bypass.
What should users do to mitigate the CVE-2026-11430 vulnerability?
Users should either properly configure a webhookToken or disable the scheduler-webhook plugin entirely to mitigate the risk.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.