{"api_version":"1","generated_at":"2026-10-12T22:06:25+00:00","cve":"CVE-2026-108924","urls":{"html":"https://cve.report/CVE-2026-108924","api":"https://cve.report/api/cve/CVE-2026-108924.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-108924","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108924"},"summary":{"title":"getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization","description":"A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.","state":"PUBLISHED","assigner":"VulDB","published_at":"2026-10-12 20:17:08","updated_at":"2026-10-12 20:17:08"},"problem_types":["CWE-285","CWE-639","CWE-639 Authorization Bypass","CWE-285 Improper Authorization"],"metrics":[{"version":"4.0","source":"cna@vuldb.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","version":"4.0"}},{"version":"3.1","source":"cna@vuldb.com","type":"Primary","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","data":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","version":"3.1"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"4.3","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","data":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","version":"3.0"}},{"version":"2.0","source":"cna@vuldb.com","type":"Secondary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"CNA","type":"DECLARED","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C","data":{"baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C","version":"2.0"}}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-108924","name":"https://vuldb.com/cve/CVE-2026-108924","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh","name":"https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/416748/cti","name":"https://vuldb.com/vuln/416748/cti","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/submit/997196","name":"https://vuldb.com/submit/997196","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h","name":"https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://vuldb.com/vuln/416748","name":"https://vuldb.com/vuln/416748","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/getkirby/kirby/","name":"https://github.com/getkirby/kirby/","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/getkirby/kirby/releases/tag/4.9.6","name":"https://github.com/getkirby/kirby/releases/tag/4.9.6","refsource":"cna@vuldb.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-108924","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108924","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 4.9.0","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 4.9.1","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 4.9.2","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 4.9.3","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 4.9.4","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 4.9.5","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 5.5.0","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 5.5.1","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 5.5.2","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"affected 5.5.3","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"unaffected 4.9.6","platforms":[]},{"source":"CNA","vendor":"getkirby","product":"Kirby","version":"unaffected 5.6.0","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-10-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"source":"CNA","time":"2026-10-11T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"source":"CNA","time":"2026-10-11T20:01:49.000Z","lang":"en","value":"VulDB entry last update"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"fernando viana (VulDB User)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"cpes":["cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*"],"modules":["Dynamic Option Generation"],"product":"Kirby","vendor":"getkirby","versions":[{"status":"affected","version":"4.9.0"},{"status":"affected","version":"4.9.1"},{"status":"affected","version":"4.9.2"},{"status":"affected","version":"4.9.3"},{"status":"affected","version":"4.9.4"},{"status":"affected","version":"4.9.5"},{"status":"affected","version":"5.5.0"},{"status":"affected","version":"5.5.1"},{"status":"affected","version":"5.5.2"},{"status":"affected","version":"5.5.3"},{"status":"unaffected","version":"4.9.6"},{"status":"unaffected","version":"5.6.0"}]}],"credits":[{"lang":"en","type":"reporter","value":"fernando viana (VulDB User)"}],"descriptions":[{"lang":"en","value":"A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component."}],"metrics":[{"cvssV4_0":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X","version":"4.0"}},{"cvssV3_1":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","version":"3.1"}},{"cvssV3_0":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C","version":"3.0"}},{"cvssV2_0":{"baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C","version":"2.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","description":"Authorization Bypass","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-285","description":"Improper Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-12T19:30:14.551Z","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB"},"references":[{"name":"VDB-416748 | getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/416748"},{"name":"VDB-416748 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/416748/cti"},{"name":"CVE-2026-108924 | CVE Analysis and Report","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-108924"},{"name":"Submit #997196 | getkirby Kirby CMS 5.6.0 Missing Authorization (CWE-862)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/997196"},{"tags":["related"],"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh"},{"tags":["broken-link"],"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h"},{"tags":["patch"],"url":"https://github.com/getkirby/kirby/releases/tag/4.9.6"},{"tags":["product"],"url":"https://github.com/getkirby/kirby/"}],"timeline":[{"lang":"en","time":"2026-10-11T00:00:00.000Z","value":"Advisory disclosed"},{"lang":"en","time":"2026-10-11T02:00:00.000Z","value":"VulDB entry created"},{"lang":"en","time":"2026-10-11T20:01:49.000Z","value":"VulDB entry last update"}],"title":"getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization","x_generator":["VulDB PVTS v202610"]}},"cveMetadata":{"assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","assignerShortName":"VulDB","cveId":"CVE-2026-108924","datePublished":"2026-10-12T19:30:14.551Z","dateReserved":"2026-10-11T17:56:44.523Z","dateUpdated":"2026-10-12T19:30:14.551Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-12 20:17:08","lastModifiedDate":"2026-10-12 20:17:08","problem_types":["CWE-285","CWE-639","CWE-639 Authorization Bypass","CWE-285 Improper Authorization"],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"108924","Ordinal":"1","Title":"getkirby Kirby Dynamic Option Generation OptionsQuery.php resolv","CVE":"CVE-2026-108924","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"108924","Ordinal":"1","NoteData":"A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.","Type":"Description","Title":"getkirby Kirby Dynamic Option Generation OptionsQuery.php resolv"}]}}}