CVE-2026-108924

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.

• CWE-285
• CWE-639

• https://github.com/getkirby/kirby/
• https://github.com/getkirby/kirby/releases/tag/4.9.6
• https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh
• https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h
• https://vuldb.com/cve/CVE-2026-108924
• https://vuldb.com/submit/997196
• https://vuldb.com/vuln/416748
• https://vuldb.com/vuln/416748/cti

Published

Oct 12, 2026

Last Modified

Oct 12, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108919A weakness has been identified in SourceCodester Drug Recomm…4.3
• CVE-2026-10892Out of bounds write in GPU in Google Chrome on Android prior…9.6
• CVE-2026-108920A security vulnerability has been detected in SourceCodester…4.3
• CVE-2026-108921A vulnerability was detected in KusalkaSilva Learning-Manage…7.3
• CVE-2026-108922A flaw has been found in KusalkaSilva Learning-Management-Sy…6.3
• CVE-2026-108923A vulnerability was determined in 1024-lab smart-admin up to…6.3
• CVE-2026-108925Improper neutralization of Script-Related HTML tags in a web…6.1
• CVE-2026-108926A security flaw has been discovered in itsourcecode Baptism …6.3
• CVE-2026-10893Use after free in Chromoting in Google Chrome prior to 149.0…8.8
• CVE-2026-10894Use after free in Printing in Google Chrome on Linux prior t…8.3
• CVE-2026-10895Use after free in Ozone in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-108950Open Source Social Network (OSSN) through 10.1 contains a mi…5.3