Authorization Bypass in getkirby Kirby Dynamic Option Generation
CVE-2026-108924

5.3MEDIUM

Key Information:

Vendor

Getkirby

Status
Kirby
Vendor
CVE Published:
12 October 2026

What is CVE-2026-108924?

A vulnerability has been identified in the getkirby Kirby CMS, specifically within the Dynamic Option Generation component. This issue, located in the OptionsQuery::resolve function found in src/Option/OptionsQuery.php, allows for an authorization bypass. Attackers could exploit this vulnerability remotely, enabling unauthorized access to restricted functionality. Users are strongly advised to upgrade to versions 4.9.6 and 5.6.0 to mitigate this risk and ensure the security of their applications.

Affected Version(s)

Kirby 4.9.0

Kirby 4.9.1

Kirby 4.9.2

References

https://vuldb.com/vuln/416748
vdb-entrytechnical-description
https://vuldb.com/vuln/416748/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-108924
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

fernando viana (VulDB User)
.