CVE-2026-21896

Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.

• CWE-863

• https://github.com/getkirby/kirby/commit/f5ce1347b427b819bf193acf11fd0da232f7af47Patch
• https://github.com/getkirby/kirby/releases/tag/5.2.2Product, Release Notes
• https://github.com/getkirby/kirby/security/advisories/GHSA-4j78-4xrm-cr2fPatch, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2189A vulnerability was identified in itsourcecode School Manage…9.8
• CVE-2026-21891ZimaOS is a fork of CasaOS, an operating system for Zima dev…9.8
• CVE-2026-21892Parsl is a Python parallel scripting library. A SQL Injectio…7.3
• CVE-2026-21893n8n is an open source workflow automation platform. From ver…7.2
• CVE-2026-21894n8n is an open source workflow automation platform. In versi…6.5
• CVE-2026-21895The `rsa` crate is an RSA implementation written in rust. Pr…5.3
• CVE-2026-21897CryptoLib provides a software-only solution using the CCSDS …7.3
• CVE-2026-21898CryptoLib provides a software-only solution using the CCSDS …8.2
• CVE-2026-21899CryptoLib provides a software-only solution using the CCSDS …4.9
• CVE-2026-2190A security flaw has been discovered in itsourcecode School M…9.8
• CVE-2026-21900CryptoLib provides a software-only solution using the CCSDS …5.9
• CVE-2026-21901A NULL Pointer Dereference vulnerability in the management d…6.7