CVE-2026-21896

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

K

irby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.

References

Link	Resource
https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47	Patch
https://github.com/getkirby/kirby/releases/tag/5.2.2	Product Release Notes
https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*

History

02 Feb 2026, 19:02

Type	Values Removed	Values Added
First Time		Getkirby Getkirby kirby
References	~~() https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47 -~~	() https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47 - Patch
References	~~() https://github.com/getkirby/kirby/releases/tag/5.2.2 -~~	() https://github.com/getkirby/kirby/releases/tag/5.2.2 - Product, Release Notes
References	~~() https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f -~~	() https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f - Patch, Vendor Advisory
CPE		cpe:2.3:a:getkirby:kirby::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.7

08 Jan 2026, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-08 18:15

Updated : 2026-02-02 19:02

NVD link : CVE-2026-21896

Mitre link : CVE-2026-21896

CVE.ORG link : CVE-2026-21896

JSON object : View

Products Affected

kirby

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-21896", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-08T18:15:59.593", "references": [{"url": "https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.2.2", "tags": ["Product", "Release Notes"], "source": "[email protected]"}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2f", "tags": ["Patch", "Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2."}], "lastModified": "2026-02-02T19:02:51.850", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9AE695A-D212-4B4E-B595-71C44FE6EE2A", "versionEndExcluding": "5.2.2", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}