CVE-2026-108924 getkirby CVE debrief

Who should care

Defenders responsible for getkirby Kirby installations, particularly those using versions up to 4.9.5/5.5.3, should assess exposure and prioritize upgrading to version 4.9.6 or 5.6.0.

Why it matters

Defenders should prioritize upgrading to version 4.9.6 or 5.6.0 to address the authorization bypass vulnerability in getkirby Kirby's Dynamic Option Generation component, as remote exploitation is possible and could lead to unauthorized access.

• Defenders must verify if their systems are running affected versions and prioritize upgrading to fixed versions.
• Remote exploitation is possible, increasing the urgency for defenders to address the vulnerability.
• The vulnerability allows for authorization bypass, potentially leading to unauthorized access.

Technical summary

The function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation in getkirby Kirby up to 4.9.5/5.5.3 is vulnerable to authorization bypass. The attack is possible to be carried out remotely. This vulnerability allows for authorization bypass, potentially leading to unauthorized access. The affected versions are up to 4.9.5/5.5.3, and upgrading to version 4.9.6 or 5.6.0 can resolve this issue. Defenders should prioritize upgrading to fixed versions to address the vulnerability.

Defensive priority

Defenders should prioritize upgrading to version 4.9.6 or 5.6.0 to address the authorization bypass vulnerability in getkirby Kirby's Dynamic Option Generation component.

Recommended defensive actions

• Upgrade to version 4.9.6 or 5.6.0 to address the authorization bypass vulnerability
• Review and update affected systems to ensure they are running a fixed version
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and the source item from cve_program_cvelist_v5. The affected versions and fixed versions are provided. Evidence is limited to CVE Program records and source item details. Defenders should verify affected systems and review CVE details for accuracy. No additional evidence or claims are made beyond source-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.