CVE-2026-63092: kirby-modules License Key Disclosure via modules/activate Dialog
kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialog handler in lib/areas.php returns the complete key via ModulesLicense::readKey() without performing an administrator check, as the dialog is gated only by the access.system permission which defaults to true for all non-admin roles, enabling attackers to use the disclosed key to activate the plugin on arbitrary third-party installations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
kirby-modulesto a version that resolves this vulnerability.Fixed in 5.5.7Patch 315417e - Compensating control
Restrict access to the Kirby Panel modules/activate dialog endpoint so that non-admin roles cannot retrieve the license key (the dialog is only gated by the access.system permission, which defaults to true for non-admin roles).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63092?
CVE-2026-63092 has a medium severity rating of 4.3.
How do I fix CVE-2026-63092?
To fix CVE-2026-63092, update the kirby-modules to the version after 5.5.7 as indicated in commit 315417e.
What type of vulnerability is CVE-2026-63092?
CVE-2026-63092 is an information disclosure vulnerability.
Who is affected by CVE-2026-63092?
Any authenticated Kirby Panel user can be affected by CVE-2026-63092.
What can be disclosed in CVE-2026-63092?
CVE-2026-63092 allows disclosure of the full plaintext commercial license key.