CVE-2026-108924: getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
getkirby Kirbyto a version that resolves this vulnerability.Fixed in 4.9.6 - Upgrade
Upgrade
getkirby Kirbyto a version that resolves this vulnerability.Fixed in 5.6.0
Event History
Frequently Asked Questions
Which deployments are affected?
getkirby Kirby versions up to 4.9.5 and up to 5.5.3 are affected in the Dynamic Option Generation component, specifically OptionsQuery::resolve.
What level of access does an attacker need?
The vulnerability can be exploited remotely and requires low privileges. No user interaction is required.
What is the security impact?
Successful exploitation can bypass authorization controls and disclose information. The provided scoring indicates no integrity or availability impact.
How can this be remediated?
Upgrade Kirby to version 4.9.6 or 5.6.0, depending on the release branch in use.