The vulnerability is an authentication bypass in Grav CMS’s scheduler‑webhook plugin. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short‑circuits and skips token validation. An unauthenticated attacker can POST to /scheduler/webhook, specify a job via the ?job= parameter, and trigger the operator’s pre‑configured scheduled job. The attacker cannot choose arbitrary commands; they only influence the timing and which pre‑configured job runs, though if that job shells out, code execution can occur.

Affected products are Trilby Media’s Grav CMS and the grav‑plugin‑scheduler‑webhook extension. Any Grav installation that has the scheduler‑webhook plugin installed, has scheduler.modern.webhook.enabled set to true, and has not defined a webhookToken is vulnerable. The plugin is not included by default in stock Grav or Grav‑Admin installs, so only sites that explicitly add the GPM plugin and enable the feature are at risk. No specific product version information is provided in the advisory.

The CVSS score of 6.9 classifies this as a moderate severity vulnerability. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no widespread public exploitation at the time of reporting. The likely attack vector is remote network access to the HTTP endpoint /scheduler/webhook; any client that can reach the Grav site can exploit the loophole. Because the flaw allows an unauthenticated user to trigger existing scheduled jobs, the impact could extend to unintended code execution if those jobs perform shell operations. Although the risk is moderate and not critical, the vulnerability remains useful for adversaries seeking to automate actions or amplify other attacks.