CVE-2026-63092

Received Received - Intake

Information Disclosure in Kirby CMS Modules

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialog handler in lib/areas.php returns the complete key via ModulesLicense::readKey() without performing an administrator check, as the dialog is gated only by the access.system permission which defaults to true for all non-admin roles, enabling attackers to use the disclosed key to activate the plugin on arbitrary third-party installations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-63092

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in kirby-modules through 5.5.7 allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialog handler returns the complete key without checking for administrator privileges, as the dialog is only gated by the access.system permission which defaults to true for all non-admin roles.

Detection Guidance

To detect this vulnerability, check if any authenticated Kirby Panel user can access the modules/activate dialog endpoint and retrieve the license key. Monitor HTTP GET requests to /modules/activate and inspect responses for plaintext license keys. Verify if non-admin users have access.system permission enabled.

Impact Analysis

An attacker with access to the Kirby Panel could exploit this to obtain the commercial license key and use it to activate the plugin on arbitrary third-party installations, potentially leading to unauthorized use or distribution of the plugin.

Mitigation Strategies

Immediately update kirby-modules to the patched commit 315417e or later. Remove access.system permission from non-admin roles. Audit logs for unauthorized access to the modules/activate endpoint. Rotate any exposed commercial license keys to prevent misuse.

Hi! I’m here to help you understand CVE-2026-63092. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70