Kirby CMS EUVD-2026-97814

Requires a valid authenticated session with at least low-level privileges (CVSS PR:L) on the Kirby instance - exploitation is not possible by a fully anonymous/unauthenticated visitor. The specific trigger is the Dynamic Option Generation feature reaching OptionsQuery::resolve in src/Option/OptionsQuery.php, so a deployment that exposes dynamic/query-driven options to lower-privileged Panel or API users is the condition that makes it reachable. Limiting factors: the mandatory authenticated privilege, the confidentiality-only impact (no integrity or availability effect), and that affected versions are Kirby up to 4.9.5 and up to 5.5.3 - instances already on 4.9.6 or 5.6.0 are not exposed.

This is a moderate, authenticated authorization-bypass issue (CWE-639) rather than a high-urgency flaw. The vendor-supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3 and is internally consistent: network-reachable (AV:N) and low complexity (AC:L), but it explicitly requires low-level privileges (PR:L) and yields only low confidentiality impact (VC:L) with no integrity or availability impact. There is no CISA KEV listing and no public exploit identified at time of analysis; the exploit maturity in the vector is undefined (E:X), so there is no evidence of active exploitation or weaponization. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in and should be checked separately. No SSVC decision data was supplied. The signals are coherent - no contradictions between vector and description - but note the authentication requirement (PR:L) meaningfully limits blast radius: an attacker needs a valid, albeit low-privileged, account. Net assessment: a real but lower-priority issue that should be patched on a normal cadence, not treated as an emergency, absent any evidence of exploitation.

An attacker who already holds a low-privileged authenticated account on a Kirby site crafts a request that drives the Dynamic Option Generation feature through OptionsQuery::resolve, causing the authorization check to be bypassed so option data they should not be permitted to see is returned. No public exploit code has been identified, and the impact is limited to low-level information disclosure (confidentiality only).