PT-2026-2126 · Kirby · Kirby

Lukaskleinschmidt · Published 2026-01-08 · Updated 2026-02-02 · CVE-2026-21896

Positive Technologies (AI Summary)

CVSS v4.0

5.8

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kirby versions 5.0.0 through 5.2.1

Description Kirby is an open-source content management system. Versions 5.0.0 through 5.2.1 are missing permission checks in the content changes API. This affects Kirby sites where user permissions are configured to prevent specific roles from performing write actions, specifically by disabling the update permission to prevent modifications to site content. The issue does not affect installations with default user permissions. The content changes API allows unauthorized modifications to site content. The vulnerable API endpoint is not specified. The vulnerable parameter or variable is not specified. The vulnerable function is not specified.

Recommendations Update to version 5.2.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-21896

GHSA-4J78-4XRM-CR2F

Affected Products

Kirby

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21896.json · Exploit
• https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47 · Patch
• https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21896 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21896 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4j78-4xrm-cr2f · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/releases/tag/5.2.2 · Note
• https://twitter.com/VulmonFeeds/status/2009490411643977785 · Twitter Post
• https://twitter.com/CVEnew/status/2009462340874588569 · Twitter Post
• https://t.me/cveNotify/150626 · Telegram Post
• https://t.me/CVEtracker/41748 · Telegram Post