Vulnerability in Trilby Media Getgrav/grav
CVE-2026-11430
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so a…
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Trilby Media Getgrav/grav — versions 0
- Trilby Media Grav-plugin-scheduler-webhook — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-11430?
- CVE-2026-11430 is a high-severity vulnerability in Trilby Media Getgrav/grav, classified under Incorrect Implementation of Authentication Algorithm. CVSS score: 7.3/10. Published 2026-08-07.
- How severe is CVE-2026-11430?
- High severity. CVSS v3 base score is 7.3 out of 10.