CVE-2026-108924
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.
| CWE | CWE-639 CWE-285 |
| Vendor | getkirby |
| Product | kirby |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for getkirby kirby
Be the first to know when new medium vulnerabilities affecting getkirby kirby are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
getkirby / Kirby
4.9.0 4.9.1 4.9.2 4.9.3 4.9.4 4.9.5 5.5.0 5.5.1 5.5.2 5.5.3
References
vuldb.com: https://vuldb.com/vuln/416748 vuldb.com: https://vuldb.com/vuln/416748/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108924 vuldb.com: https://vuldb.com/submit/997196 github.com: https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh github.com: https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h github.com: https://github.com/getkirby/kirby/releases/tag/4.9.6 github.com: https://github.com/getkirby/kirby/
Credits
🔍 fernando viana (VulDB User)