Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-63092kirby-modules License Key Disclosure via modules/activate Dialog

Medium 4.3

In plain English

A medium-severity missing authorization in kirby-modules from medienbaecker. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialog handler in lib/areas.php returns the complete key via ModulesLicense::readKey() without performing an administrator check, as the dialog is gated only by the access.system permission which defaults to true for all non-admin roles, enabling attackers to use the disclosed key to activate the plugin on arbitrary third-party installations.

Affected products (as reported)

Vendor	Product	Versions
medienbaecker	kirby-modules	0 – through 5.5.7

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Patch Commit patch
https://www.vulncheck.com/advisories/kirby-modules-license-key-disclosure-via-modules-activate-dialog third-party-advisory