CVE-2026-57852 describes an authentication bypass vulnerability in the Trilby Media Grav CMS scheduler-webhook plugin. The issue stems from incorrect implementation of the authentication algorithm (CWE-303), specifically a short-circuit logic flaw in validating the webhook token. This flaw enables unauthenticated attackers to send a POST request to the scheduler webhook endpoint and cause execution of all or specific scheduled jobs. These jobs run with the privileges of the web server process user, potentially leading to unauthorized command execution. No patch or official remediation has been disclosed as of the published date.

Successful exploitation allows unauthenticated remote attackers to trigger scheduled jobs arbitrarily, resulting in unintended execution of commands with the web server's privileges. This can lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: Low).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the scheduler webhook endpoint where possible and monitor for suspicious POST requests targeting this endpoint. Avoid exposing the webhook endpoint publicly if feasible.