CVE-2026-108924: getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-16
Weakness: CWE-285

Description

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.

Affected products

getkirby kirby: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4, 4.9.5 (+4)

References

https://github.com/getkirby/kirby/
https://github.com/getkirby/kirby/releases/tag/4.9.6
https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh
https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h
https://vuldb.com/cve/CVE-2026-108924
https://vuldb.com/submit/997196
https://vuldb.com/vuln/416748
https://vuldb.com/vuln/416748/cti

Get alerted when CVE-2026-108924 or the next vulnerability affects your stack