CVE-2026-108924
Deferred Deferred - Pending Action

Authorization Bypass in Kirby CMS

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108924
EUVD
EUVD-2026-97814

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
getkirby Kirby 4.9.0
getkirby Kirby 4.9.1
getkirby Kirby 4.9.2
getkirby Kirby 4.9.3
getkirby Kirby 4.9.4
getkirby Kirby 4.9.5
getkirby Kirby 5.5.0
getkirby Kirby 5.5.1
getkirby Kirby 5.5.2
getkirby Kirby 5.5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Kirby CMS up to versions 4.9.5 and 5.5.3. It exists in the OptionsQuery::resolve function of the Dynamic Option Generation component. The flaw allows remote attackers to bypass access controls due to improper authorization checks.

Detection Guidance

To detect this vulnerability, check the installed version of Kirby. If it is 4.9.5 or below or 5.5.3 or below, the system is vulnerable. Run commands like 'composer show getkirby/kirby' or check the version in the admin panel or configuration files.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data or functions within the Kirby CMS. The CVSS scores indicate moderate severity with potential for data exposure or system manipulation. Upgrading to versions 4.9.6 or 5.6.0 is recommended to mitigate the risk.

Compliance Impact

This vulnerability allows unauthorized access to sensitive information such as page titles, UUIDs, usernames, email addresses, and file media URLs with authorization tokens. This could lead to violations of GDPR (data protection) and HIPAA (patient data privacy) by exposing personal or confidential data without proper authorization.

Mitigation Strategies

Upgrade Kirby to version 4.9.6 or 5.6.0 or later. This resolves the authorization bypass issue. Follow the official Kirby upgrade guide for your installation method (e.g., Composer, manual update).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart