CVE-2026-21896
Medium · 5.7CVSS
5.7
EPSS
0.2%
Published
Jan 8, 2026
CISA due date
—
The record
Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | getkirby/cms | 5.0.0 | 5.2.2 |
| packagist | getkirby/cms | 5.0.0 | 5.2.2 |
Related vulnerabilities
- GHSA-4j78-4xrm-cr2f Kirby is missing permission checks in the content changes API Same vulnerability
- GHSA-84hf-8gh5-575j Kirby CMS has cross-site scripting (XSS) in the changes dialog Also affects getkirby/cms
- CVE-2025-65012 Kirby CMS has cross-site scripting (XSS) in the changes dialog Also affects getkirby/cms
- CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96384 Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful… CWE-863
- CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request… CWE-863
- CVE-2026-96373 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863
- CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. CWE-863