CVE-2026-108924

Executive Summary

CVE-2026-108924 is an authorization bypass vulnerability in the Kirby content management system, affecting versions up to 4.9.5 and 5.5.3. The flaw resides in the OptionsQuery::resolve method within src/Option/OptionsQuery.php, part of the Dynamic Option Generation component. An authenticated attacker with low privileges can remotely exploit this issue to bypass authorization controls, potentially accessing or manipulating data they should not have permission to view. The vulnerability has a CVSS score of 4.3, indicating a moderate severity with low confidentiality impact, and is currently unpatched with no public exploit code available.

Technical Analysis

The vulnerability is classified as CWE-285: Improper Authorization. It specifically affects the OptionsQuery::resolve function in the src/Option/OptionsQuery.php file of the Kirby CMS. This component is responsible for dynamically generating options, likely for administrative interfaces or content management workflows.

The core issue is an authorization bypass that occurs when the OptionsQuery::resolve method processes requests. The manipulation of input to this function leads to improper authorization checks, allowing an attacker to bypass intended access controls. The attack vector is network-based (AV:N), requiring low privileges (PR:L), and no user interaction (UI:N). The CVSS vector indicates low confidentiality impact (C:L), with no impact on integrity or availability.

While the exact technical mechanism is not detailed in the available intelligence, the vulnerability class suggests that the function fails to properly validate user permissions before resolving or returning option data. This could allow an attacker to enumerate or access options that are restricted to higher-privileged users, potentially exposing sensitive configuration details or content structure.

Exploitation Scenarios

1. Reconnaissance/Target Identification: An attacker identifies a target running Kirby CMS versions up to 4.9.5 or 5.5.3. This can be done through Shodan dorks or by fingerprinting the application's response headers and HTML content.
2. Triggering the Flaw: The attacker, possessing low-privileged credentials (e.g., a registered user or a compromised account), sends crafted requests to endpoints that invoke the OptionsQuery::resolve function. The manipulation of input parameters to this function bypasses authorization checks.
3. Payload/Execution Method: The exact payload is not publicly known. However, at the vulnerability-class level, the attacker would manipulate the query or parameters passed to OptionsQuery::resolve to force it to return data that should be restricted. This could involve altering option identifiers, query structures, or other input that the function uses to determine authorization.
4. Post-Exploitation Impact: Successful exploitation allows the attacker to view or potentially modify configuration options or content that are normally restricted. This could lead to information disclosure, such as revealing internal paths, user data, or other sensitive settings. The low confidentiality impact suggests the primary risk is unauthorized data access rather than full system compromise.

Impact Assessment

The CVSS score of 4.3 reflects a moderate severity. The attack requires network access and low privileges, meaning an attacker must have a valid account on the Kirby instance. The scope is unchanged (S:U), and only confidentiality is impacted (C:L). There is no impact on integrity or availability. Business impact includes potential unauthorized access to sensitive information stored within the CMS, such as unpublished content, user details, or configuration settings. The blast radius is limited to the confidentiality of data accessible through the Dynamic Option Generation component. Organizations using Kirby for public-facing websites or internal portals should consider this a significant risk if they host sensitive information or have multiple user roles.

Detection Guidance

Sigma Rule

title: Kirby CMS Authorization Bypass via OptionsQuery::resolve
id: 3b8e1f2a-4c5d-6e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects exploitation attempts of CVE-2026-108924 in Kirby CMS via unusual access to OptionsQuery endpoints.
author: Threat Intelligence Team
date: 2026-05-15
logsource:
  category: webserver
  product: generic
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains: 'options'
    sc-status: 200
  condition: selection
falsepositives:
  - Legitimate administrative activity
level: medium

YARA Rule

rule CVE_2026_108924_Kirby_AuthBypass
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-108924 in Kirby CMS"
        author = "Threat Intelligence Team"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108924"
    strings:
        $s1 = "OptionsQuery::resolve" ascii wide
        $s2 = "src/Option/OptionsQuery.php" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108924 Kirby CMS Authorization Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"options"; http_uri; nocase; content:"resolve"; http_uri; nocase; sid:1000001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name == "php" and process.args : "*OptionsQuery*" and process.args : "*resolve*"

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*options*" uri_path="*resolve*" status=200
| stats count by src_ip, uri_path, status
| where count > 10

Wazuh OSSEC Rule

<group name="web,app,">
  <rule id="100001" level="7">
    <decoded_as>json</decoded_as>
    <field name="url">options</field>
    <field name="url">resolve</field>
    <description>CVE-2026-108924: Kirby CMS Authorization Bypass Attempt</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations: Restrict access to the Kirby admin panel and any endpoints that utilize the Dynamic Option Generation component to trusted IP addresses only. Implement additional authorization checks at the web server or reverse proxy level. Monitor logs for suspicious access patterns to option-related endpoints.
2. Patch/Upgrade Steps: Upgrade to Kirby version 4.9.6 or 5.6.0 as specified in the NVD description. Ensure all instances are updated promptly.
3. Long-term Hardening: Follow the principle of least privilege for user roles. Conduct regular security audits of custom plugins and themes that may interact with OptionsQuery::resolve. Implement Web Application Firewall (WAF) rules to detect and block anomalous requests to option endpoints.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-108924
2. Kirby CMS Official Website: https://getkirby.com
3. CWE-285: Improper Authorization: https://cwe.mitre.org/data/definitions/285.html
4. Kirby Security Advisories: https://getkirby.com/security
5. MITRE ATT&CK T1078: https://attack.mitre.org/techniques/T1078/