Vulnerability · Published Jan 8, 2026 · Assigned by GitHub_M

CVE-2026-21896Kirby is missing permission checks in the content changes API

Medium 5.8

In plain English

A medium-severity incorrect authorization in kirby from getkirby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.8Medium

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getkirby/cms	5.2.2	GHSA-4j78-4xrm-cr2f

Affected products (as reported)

Vendor	Product	Versions
getkirby	kirby	>= 5.0.0, < 5.2.2

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f x_refsource_CONFIRM
https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47 x_refsource_MISC
https://github.com/getkirby/kirby/releases/tag/5.2.2 x_refsource_MISC