CVE-2026-21896

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21896
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21896.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21896
Aliases
Published
2026-01-08T18:09:10.362Z
Modified
2026-03-01T02:56:02.397843Z
Severity
  • 5.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kirby is missing permission checks in the content changes API
Details

Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21896.json",
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/getkirby/kirby

Affected ranges

Type
GIT
Repo
https://github.com/getkirby/kirby
Events
Introduced
2ff182ba39ddea19fa1615bd3733f734b5e53842
Fixed
55563aa1597d9e9fd2b9cb3f8ad53ef99916ae82

Affected versions

5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1.0
5.1.0-rc.1
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.0-rc.1
5.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21896.json"