CVE-2026-108924: medium-severity vulnerability in getkirby Kirby
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.4%
from disclosure to weapon1 days
Published on NVDOct 12
1st PoC+1d
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Affected products
getkirby · Kirbypublic PoCs found — 1
githubgithub.com/capivara-research/CVE-2026-108924★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/getkirby/kirby/https://github.com/getkirby/kirby/releases/tag/4.9.6https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfhhttps://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6hhttps://vuldb.com/cve/CVE-2026-108924https://vuldb.com/submit/997196https://vuldb.com/vuln/416748https://vuldb.com/vuln/416748/cti