https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 01:29:04 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265204 EUVD-2026-265204 https://cve.radiocsirt.org/vuln/euvd-2026-265204 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21896 <p>Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.</p> <p>Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21896 https://cve.radiocsirt.org/vuln/ghsa-4j78-4xrm-cr2f <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the `update` permission with the intent to prevent modifications to site content.</p> <p>If developers haven&#39;t configured any user permissions that deviate from the default of allowing all actions, their site is *not* affected.</p> <p>----</p> <p>### Introduction</p> <p>Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.</p> <p>Permissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby&#39;s API backend code during operations to the changes version.</p> <p>The changes version is the content version that contains unsaved changes of existing models (pages, users, files or the site).</p> <p>### Impact</p> <p>The missing permission checks allowed attackers with Panel access to create or discard a changes version or update the content fields in an existing changes version. All of these actions could affect arbitrary models.</p> <p>This could cause the following impact:</p> <p>- Attackers could maliciously create changes versions for all models of the site, creating editing locks that would prevent other authenticated users from making content changes until those locks were cleared. - Attackers could update the content in a malicious way, for example by adding defamatory or spam content or by including malicious links or scripts. Whi…</p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the `update` permission with the intent to prevent modifications to site content.</p> <p>If developers haven&#39;t configured any user permissions that deviate from the default of allowing all actions, their site is *not* affected.</p> <p>----</p> <p>### Introduction</p> <p>Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.</p> <p>Permissions for updating content have already existed and could be configured for each model type, but were not enforced by Kirby&#39;s API backend code during operations to the changes version.</p> <p>The changes version is the content version that contains unsaved changes of existing models (pages, users, files or the site).</p> <p>### Impact</p> <p>The missing permission checks allowed attackers with Panel access to create or discard a changes version or update the content fields in an existing changes version. All of these actions could affect arbitrary models.</p> <p>This could cause the following impact:</p> <p>- Attackers could maliciously create changes versions for all models of the site, creating editing locks that would prevent other authenticated users from making content changes until those locks were cleared. - Attackers could update the content in a malicious way, for example by adding defamatory or spam content or by including malicious links or scripts. Whi…</p> https://cve.radiocsirt.org/vuln/ghsa-4j78-4xrm-cr2f