Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-20 | 2 | Disclosure2 |
| 2026-07-21 | 1 | Disclosure1 |
CVE-2026-57852 Authentication Bypass in Grav CMS Scheduler-Webhook Plugin Enables Unauthenticated Job Execution https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-57852
Post summary
The text announces an authentication bypass that allows unauthenticated job execution in the Grav CMS Scheduler-Webhook Plugin, but it offers no further technical details or additional context.
🚨*CVE* CVE-2026-57852 Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by… https://www.cve.org/CVERecord?id=CVE-2026-57852 ----- Traducción: CVE-2026-57852 Gra… http://infoflow.cloud`
Post summary
The message announces CVE‑2026‑57852, detailing an authentication‑bypass flaw in the Grav CMS scheduler‑webhook plugin that lets unauthenticated remote attackers trigger scheduled jobs.
CVE-2026-57852 Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by… https://www.cve.org/CVERecord?id=CVE-2026-57852
Post summary
The CVE-2026-57852 disclosure highlights an authentication bypass in Grav CMS’ scheduler‑webhook plugin that lets unauthenticated attackers trigger scheduled jobs.