CVE-2026-21896
published 2026-01-08CVE-2026-21896: Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This…
PriorityP432medium5.7CVSS 3.1
AVNACLPRLUIRSUCNIHAN
EPSS
0.19%
8.7th percentile
Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getkirby | cms | >= 5.0.0 < 5.2.2 | 5.2.2 |
| getkirby | kirby | — | — |
| getkirby | kirby | >= 5.0.0 < 5.2.2 | 5.2.2 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
nvdv4.05.8MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Kirby is missing permission checks in the content changes API
ghsa·2026-01-08
CVE-2026-21896 [MEDIUM] CWE-863 Kirby is missing permission checks in the content changes API
Kirby is missing permission checks in the content changes API
### TL;DR
This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the `update` permission with the intent to prevent modifications to site content.
If developers haven't configured any user permissions that deviate from the default of allowing all actions, their site is *not* affected.
----
### Introduction
Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.
Permissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby's API backend code during operations to the changes version.
OSV
Kirby is missing permission checks in the content changes API
osv·2026-01-08
CVE-2026-21896 [MEDIUM] Kirby is missing permission checks in the content changes API
Kirby is missing permission checks in the content changes API
### TL;DR
This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the `update` permission with the intent to prevent modifications to site content.
If developers haven't configured any user permissions that deviate from the default of allowing all actions, their site is *not* affected.
----
### Introduction
Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.
Permissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby's API backend code during operations to the changes version.
No detection rules found.
No public exploits indexed.
2026-01-08
Published