CVE-2026-108924 Details
Description
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.
An authorization bypass vulnerability has been identified in Getkirby Kirby versions through 4.9.5 and 5.5.3. The issue arises in the Dynamic Option Generation component, specifically within the OptionsQuery::resolve function in src/Option/OptionsQuery.php. This vulnerability allows for remote exploitation, where an authenticated Panel user with update permissions can access and manipulate data from fields that are supposed to be restricted based on user roles.
Users are advised to upgrade to Kirby versions 4.9.6 or 5.6.0, where this vulnerability has been patched. Instructions for upgrading can be found in the Kirby repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/ | [email protected] | ProductVendor |
| https://github.com/getkirby/kirby/releases/tag/4.9.6 | [email protected] | Release NotesVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh | [email protected] | AdvisoryRemedyVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h | [email protected] | AdvisoryBroken LinkVendor |
| https://vuldb.com/cve/CVE-2026-108924 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/997196 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416748 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416748/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| getkirby Kirby | <= 4.9.5 (semver) >= 5.0.0, <= 5.5.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |