5.3
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.
Засегнати продукти
- getkirby Kirby: 4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4; 4.9.5; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 4.9.6; 5.6.0
Вид слабост
История
- 12 октомври 2026 Публикувано
Други уязвимости в getkirby Kirby
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-108924
- https://nvd.nist.gov/vuln/detail/CVE-2026-108924
- https://vuldb.com/vuln/416748
- https://vuldb.com/vuln/416748/cti
- https://vuldb.com/cve/CVE-2026-108924
- https://vuldb.com/submit/997196
- https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh
- https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h
- https://github.com/getkirby/kirby/releases/tag/4.9.6
- https://github.com/getkirby/kirby/