CVE-2026-108924

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-285, CWE-639

Impact

Authenticated remote users can bypass authorization controls to access restricted option data. Attackers only need low-privilege network access to the Kirby instance.

Root cause

Improper authorization checks in the dynamic option generation logic inside OptionsQuery::resolve permit unauthorized object access.

Affected systems

Kirby versions up to 4.9.5 and up to 5.5.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to Kirby version 4.9.6 or 5.6.0. No interim mitigations or workarounds are listed, so prioritize patching.

shell

$ composer update getkirby/cms

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108924