CVE-2026-57852

MediumCVSS 5.6/10Last modified Oct 24, 2026

Description

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-303

Affected software

No affected versions have been published.

Timeline

Published: Jul 20, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-578558.8Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules CVE-2026-578568.8Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System CVE-2026-578574.3The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout pa CVE-2026-578588.9Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that CVE-2026-578597.5e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-CVE-2026-57868.8An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attac CVE-2026-578607.8ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mc CVE-2026-578628.5Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by CVE-2026-578638.8Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to writ CVE-2026-578668.8Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_genera CVE-2026-578678.8MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting CVE-2026-578687.1MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: thro