CVE-2026-108924: falha de média gravidade em getkirby Kirby
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
Publicada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.4%
da publicação à arma1 dias
Publicada no NVD12 de out.
1ª PoC+1d
probabilidade de exploração
0.4%top 67% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Produtos afetados
getkirby · KirbyPoCs públicas encontradas — 1
githubgithub.com/capivara-research/CVE-2026-108924★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/getkirby/kirby/https://github.com/getkirby/kirby/releases/tag/4.9.6https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfhhttps://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6hhttps://vuldb.com/cve/CVE-2026-108924https://vuldb.com/submit/997196https://vuldb.com/vuln/416748https://vuldb.com/vuln/416748/cti