Read the docs
TI-2024-27985 Aliases CVE-2024-41964GHSA-jm9m-rqr3-wfmh

Insufficient permission checks in the language settings in Kirby CMS

Priority LOW 36CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions. Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's frontend or backend code. A permission for updating existing languages has not existed before the patched versions. So disabling the languages.* wildcard permission for a role could not have prohibited updates to existing language definitions. The missing permission checks allowed attackers with Panel access to manipulate the language definitions. The problem has been patched in Kirby 3.6.6.6, Kirby 3.7.5.5, Kirby 3.8.4.4, Kirby 3.9.8.2, Kirby 3.10.1.1, and Kirby 4.3.1. Please update to one of these or a later version to fix the vulnerability. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0048 41st percentileScored 2026-11-07
Fix Fixed kirby (getkirby): 3.6.6.6, 3.7.5.5, 3.8.4.4 +3getkirby/cms (Packagist): 3.6.6.6, 3.7.5.5, 3.8.4.4 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getkirbykirbybefore 3.6.6.6; 3.7.0 to before 3.7.5.5; 3.8.0 to before 3.8.4.4; 3.9.0 to before 3.9.8.2; 3.10.0 to before 3.10.1.1; 4.0.0 to before 4.3.13.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1Patch availableCNA
—getkirby/cms (Packagist)before 3.6.6.63.6.6.6Patch availableGHSA-jm9m-rqr3-wfmh
—getkirby/cms (Packagist)3.7.0 to before 3.7.5.53.7.5.5Patch availableGHSA-jm9m-rqr3-wfmh
—getkirby/cms (Packagist)3.8.0 to before 3.8.4.43.8.4.4Patch availableGHSA-jm9m-rqr3-wfmh
—getkirby/cms (Packagist)3.9.0 to before 3.9.8.23.9.8.2Patch availableGHSA-jm9m-rqr3-wfmh
—getkirby/cms (Packagist)3.10.0 to before 3.10.1.13.10.1.1Patch availableGHSA-jm9m-rqr3-wfmh
—getkirby/cms (Packagist)4.0.0 to before 4.3.14.3.1Patch availableGHSA-jm9m-rqr3-wfmh
  • kirby Vendorgetkirby Affected before 3.6.6.6; 3.7.0 to before 3.7.5.5; 3.8.0 to before 3.8.4.4; 3.9.0 to before 3.9.8.2; 3.10.0 to before 3.10.1.1; 4.0.0 to before 4.3.1 Fixed in 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1 Patch available CNA
  • getkirby/cms (Packagist) Vendor— Affected before 3.6.6.6 Fixed in 3.6.6.6 Patch available GHSA-jm9m-rqr3-wfmh
  • getkirby/cms (Packagist) Vendor— Affected 3.7.0 to before 3.7.5.5 Fixed in 3.7.5.5 Patch available GHSA-jm9m-rqr3-wfmh
  • getkirby/cms (Packagist) Vendor— Affected 3.8.0 to before 3.8.4.4 Fixed in 3.8.4.4 Patch available GHSA-jm9m-rqr3-wfmh
  • getkirby/cms (Packagist) Vendor— Affected 3.9.0 to before 3.9.8.2 Fixed in 3.9.8.2 Patch available GHSA-jm9m-rqr3-wfmh
  • getkirby/cms (Packagist) Vendor— Affected 3.10.0 to before 3.10.1.1 Fixed in 3.10.1.1 Patch available GHSA-jm9m-rqr3-wfmh
  • getkirby/cms (Packagist) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jm9m-rqr3-wfmh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*before 3.6.6.6; 3.7.0 to before 3.7.5.5; 3.8.0 to before 3.8.4.4; 3.9.0 to before 3.9.8.2; 3.10.0 to before 3.10.1.1; 4.0.0 to before 4.3.1Vulnerablegetkirby
  • cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* Versions before 3.6.6.6; 3.7.0 to before 3.7.5.5; 3.8.0 to before 3.8.4.4; 3.9.0 to before 3.9.8.2; 3.10.0 to before 3.10.1.1; 4.0.0 to before 4.3.1 Vulnerable ·getkirby

Remediation

  • Fix · CNA kirby (getkirby) Fixed in 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1
  • Fix · GHSA-jm9m-rqr3-wfmh getkirby/cms (Packagist) Fixed in 3.6.6.6 Advisory →
  • Fix · GHSA-jm9m-rqr3-wfmh getkirby/cms (Packagist) Fixed in 3.7.5.5 Advisory →
  • Fix · GHSA-jm9m-rqr3-wfmh getkirby/cms (Packagist) Fixed in 3.8.4.4 Advisory →
  • Fix · GHSA-jm9m-rqr3-wfmh getkirby/cms (Packagist) Fixed in 3.9.8.2 Advisory →
  • Fix · GHSA-jm9m-rqr3-wfmh getkirby/cms (Packagist) Fixed in 3.10.1.1 Advisory →
  • Fix · GHSA-jm9m-rqr3-wfmh getkirby/cms (Packagist) Fixed in 4.3.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-41964
  2. 2026-10-03 Alias added: GHSA-jm9m-rqr3-wfmh

References

Patch 1

Advisory 2

Other 12

  • TI-2024-17440 An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0… CVSS 3.1HIGH 8.8
  • TI-2024-17439 An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS… CVSS 3.1HIGH 7.1
  • TI-2026-23396 Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a… CVSS 3.1MEDIUM 6.5
  • TI-2024-17441 A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of… CVSS 3.1MEDIUM 6.1
  • TI-2018-10413 An issue was discovered in Kirby 2.5.12. CVSS 3.1MEDIUM 5.4
  • TI-2024-17438 Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. CVSS 3.1MEDIUM 4.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences