An authentication bypass in the Grav CMS scheduler-webhook plugin exposes the system to unauthorized actions by unauthenticated attackers.

This vulnerability is an authentication bypass (CWE-303) resulting from an incorrect implementation of the webhook token validation logic. It allows an attacker to bypass security checks without requiring any authentication.

With a CVSS score of 7.3, this vulnerability allows unauthenticated access to system functions, which could be leveraged to trigger unauthorized webhooks. This may lead to information disclosure or the execution of unintended tasks within the Grav CMS environment, potentially disrupting site operations.

Immediate Action: Update the grav-plugin-scheduler-webhook plugin to version 1.1.3 or later to resolve the token validation defect.

Proactive Monitoring: Review application logs for suspicious or unauthorized webhook triggers originating from unknown sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and filter incoming requests to the scheduler-webhook endpoint until the update can be applied.

Public Exploit Available: No confirmed public exploit available.

This vulnerability is highly concerning due to its ability to be exploited without authentication. Users of the Grav CMS scheduler-webhook plugin must treat the update to version 1.1.3 as an urgent requirement to prevent unauthorized system interaction.