grav-plugin-scheduler-webhook vulnerabilities

CVEs whose affected-version data names the grav-plugin-scheduler-webhook package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-11430High· 7.3

1mo ago

Grav CMS Scheduler Webhook Authentication Bypass via Null Short-Circuit

Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so…

▾ TwilightTrilby Media · grav-plugin-scheduler-webhookEPSS 0.96%via CVEORG