CVE-2026-57852: Trilby Media Grav CMS Scheduler-Webhook Plugin

Medium severity, CVSS 5.6. EPSS: 0.7% chance of exploitation in the next 30 days.

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.

Affected products

• Trilby Media Grav CMS Scheduler-Webhook Plugin: up to and including 1.1.3; up to and including 2.0.8

Published 2026-07-20. Last modified 2026-07-21.