What’s Vulnerable › Vulnerabilities

CVE-2026-21896: Kirby is missing permission checks in the content changes API

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-08 · updated 2026-06-17
• Weakness: CWE-863

Description

Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.

Affected products

• getkirby kirby: from 5.0.0 before 5.2.2 — fixed in 5.2.2

How to fix

Upgrade to a fixed version: getkirby kirby 5.2.2. Check the vendor advisory for mitigations.

References

• https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47
• https://github.com/getkirby/kirby/releases/tag/5.2.2
• https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f

Get alerted when CVE-2026-21896 or the next vulnerability affects your stack