CVE-2026-11430 describes an authentication bypass in the Grav CMS grav-plugin-scheduler-webhook. When the scheduler-webhook plugin is installed and the webhook feature is enabled (scheduler.modern.webhook.enabled=true) without configuring a webhookToken, a conditional check short-circuits, skipping token validation. This allows unauthenticated remote attackers to trigger already-configured scheduled jobs via POST requests to /scheduler/webhook with a ?job= parameter specifying which job to run. The vulnerability does not allow direct command execution; code execution depends on the operator's job configuration that may shell out. The attacker controls timing and job selection but not the payload or job content. Default Grav or Grav-Admin installations are not affected as the plugin is not installed and the webhook feature is disabled by default.

An unauthenticated remote attacker can trigger existing scheduled jobs configured by the operator, potentially causing unintended job execution. The attacker cannot create or modify jobs or control job payloads, limiting the impact to timing and selection of pre-existing jobs. Code execution is only possible if the operator has configured a job that executes shell commands. This vulnerability does not affect default Grav installations and requires specific plugin and configuration conditions.

No official fix or patch is currently documented. Mitigation involves ensuring that if the scheduler-webhook plugin is installed and the webhook feature is enabled, a webhookToken must be configured to enforce authentication. Alternatively, disable the scheduler-webhook plugin or the webhook feature if not needed. Monitor vendor advisories for updates or official patches. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.