CVE-2026-108924

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108924", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-10-11T17:56:44.523Z", "datePublished": "2026-10-12T19:30:14.551Z", "dateUpdated": "2026-10-16T17:19:37.353Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-12T19:30:14.551Z"}, "title": "getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "getkirby", "product": "Kirby", "versions": [{"version": "4.9.0", "status": "affected"}, {"version": "4.9.1", "status": "affected"}, {"version": "4.9.2", "status": "affected"}, {"version": "4.9.3", "status": "affected"}, {"version": "4.9.4", "status": "affected"}, {"version": "4.9.5", "status": "affected"}, {"version": "5.5.0", "status": "affected"}, {"version": "5.5.1", "status": "affected"}, {"version": "5.5.2", "status": "affected"}, {"version": "5.5.3", "status": "affected"}, {"version": "4.9.6", "status": "unaffected"}, {"version": "5.6.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*"], "modules": ["Dynamic Option Generation"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-10-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-10-11T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-11T20:01:49.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "fernando viana (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/416748", "name": "VDB-416748 | getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/416748/cti", "name": "VDB-416748 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-108924", "name": "CVE-2026-108924 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/997196", "name": "Submit #997196 | getkirby Kirby CMS 5.6.0 Missing Authorization (CWE-862)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh", "tags": ["related"]}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h", "tags": ["broken-link"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.6", "tags": ["patch"]}, {"url": "https://github.com/getkirby/kirby/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-16T16:31:03.471669Z", "id": "CVE-2026-108924", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T17:19:37.353Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-108924", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T16:31:03.471669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T16:31:04.751Z"}}], "cna": {"title": "getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization", "credits": [{"lang": "en", "type": "reporter", "value": "fernando viana (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*"], "vendor": "getkirby", "modules": ["Dynamic Option Generation"], "product": "Kirby", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}, {"status": "affected", "version": "4.9.5"}, {"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "5.5.1"}, {"status": "affected", "version": "5.5.2"}, {"status": "affected", "version": "5.5.3"}, {"status": "unaffected", "version": "4.9.6"}, {"status": "unaffected", "version": "5.6.0"}]}], "timeline": [{"lang": "en", "time": "2026-10-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-10-11T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-11T20:01:49.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/416748", "name": "VDB-416748 | getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/416748/cti", "name": "VDB-416748 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-108924", "name": "CVE-2026-108924 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/997196", "name": "Submit #997196 | getkirby Kirby CMS 5.6.0 Missing Authorization (CWE-862)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh", "tags": ["related"]}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h", "tags": ["broken-link"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.6", "tags": ["patch"]}, {"url": "https://github.com/getkirby/kirby/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-12T19:30:14.551Z"}}}, "cveMetadata": {"cveId": "CVE-2026-108924", "state": "PUBLISHED", "dateUpdated": "2026-10-16T17:19:37.353Z", "dateReserved": "2026-10-11T17:56:44.523Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-10-12T19:30:14.551Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*"], "modules": ["Dynamic Option Generation"], "product": "Kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}, {"status": "affected", "version": "4.9.5"}, {"status": "affected", "version": "5.5.0"}, {"status": "affected", "version": "5.5.1"}, {"status": "affected", "version": "5.5.2"}, {"status": "affected", "version": "5.5.3"}, {"status": "unaffected", "version": "4.9.6"}, {"status": "unaffected", "version": "5.6.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component."}], "id": "CVE-2026-108924", "lastModified": "2026-10-16T18:17:29.653", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108924", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T16:31:03.471669Z", "version": "2.0.3"}}]}, "published": "2026-10-12T20:17:08.457", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/getkirby/kirby/"}, {"source": "cna@vuldb.com", "url": "https://github.com/getkirby/kirby/releases/tag/4.9.6"}, {"source": "cna@vuldb.com", "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh"}, {"source": "cna@vuldb.com", "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-108924"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/997196"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/416748"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/416748/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.9.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.6.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Kirby", "source": "cna", "vendor": "getkirby"}, "product": "kirby", "vendor": "getkirby"}], "created": "2026-10-12T20:30:15.491260+00:00", "updated": "2026-10-12T21:15:07.250268+00:00", "vendors": ["getkirby", "getkirby$PRODUCT$kirby"]}