Summary
Kirby is missing permission checks in the content changes API
TL;DR
This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content.
If developers haven't configured any user permissions that deviate from the default of allowing all actions, their site is not affected.
Introduction
Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.
Permissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby's API backend code during operations to the changes version.
The changes version is the content version that contains unsaved changes of existing models (pages, users, files or the site).
Credits
Thanks to Lukas Kleinschmidt (@lukaskleinschmidt) for responsibly reporting the identified issue.
Impact
The missing permission checks allowed attackers with Panel access to create or discard a changes version or update the content fields in an existing changes version. All of these actions could affect arbitrary models.
This could cause the following impact:
- Attackers could maliciously create changes versions for all models of the site, creating editing locks that would prevent other authenticated users from making content changes until those locks were cleared.
- Attackers could update the content in a malicious way, for example by adding defamatory or spam content or by including malicious links or scripts. While this updated content would not immediately be published to the site, an inattentive editor with update permissions could inadvertently publish these changes in the belief that an authorized user has made them.
- Attackers could discard extensive changes, making editors lose their content work.
The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The problem has been patched in Kirby 5.2.2. Please update to this or a later version to fix the vulnerability.
In the mentioned release, we have added checks for the model update permissions that ensure that users without this permission cannot create, edit or discard the changes version of the respective model.
A future Kirby release will add separate edit and save permissions that will make it possible to control write actions to model content more granularly.
Frequently Asked Questions
- What is CVE-2026-21896? CVE-2026-21896 is a medium-severity incorrect authorization vulnerability in getkirby/cms (composer), affecting versions >= 5.0.0, <= 5.2.1. It is fixed in 5.2.2. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
- Which versions of getkirby/cms are affected by CVE-2026-21896? getkirby/cms (composer) versions >= 5.0.0, <= 5.2.1 is affected.
- Is there a fix for CVE-2026-21896? Yes. CVE-2026-21896 is fixed in 5.2.2. Upgrade to this version or later.
- Is CVE-2026-21896 exploitable, and should I be worried? Whether CVE-2026-21896 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-21896 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-21896? Upgrade
getkirby/cmsto 5.2.2 or later.