GHSA-jm9m-rqr3-wfmh CVE-2024-41964

Kirby has insufficient permission checks in the language settings

High Packagist

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.48%; Chance of exploitation in the next 30 days. Higher than 41.42% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-863 Incorrect Authorization
Fix: 3.6.6.6; Upgrade getkirby/cms to this version or later

Description

TL;DR

This vulnerability affects all Kirby sites with enabled languages option that might have potential attackers in the group of authenticated Panel users.

If you have disabled the languages and/or api option and don't call any methods in your code that cause a write access to languages (language creation, update or deletion), your site is not affected.

Introduction

Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted actions.

Permissions for creating and deleting languages have already existed and could be configured, but were not enforced by Kirby's frontend or backend code.

A permission for updating existing languages has not existed before the patched versions. So disabling the languages.* wildcard permission for a role could not have prohibited updates to existing language definitions.

Impact

The missing permission checks allowed attackers with Panel access to manipulate the language definitions.

The language definitions are at the core of multi-language content in Kirby. Unauthorized modifications with malicious intent can cause significant damage, for example:

If the languages option was enabled but no language exists, creating the first language will switch Kirby to multi-language mode.
Deleting an existing language will lead to content loss of all translated content in that language. Deleting the last language will switch Kirby to single-language mode.
Updating a language allows to change the metadata including the language slug (used in page URLs) and language variables. It also allows to change the default language, which will cause Kirby to use the new default language's content as a fallback for non-existing translations.

Depending on the site code, the result of such actions can cause loss of site availability (e.g. error messages in the site frontend) or integrity (due to changed URLs or removed translations).

Patches

The problem has been patched in Kirby 3.6.6.6, Kirby 3.7.5.5, Kirby 3.8.4.4, Kirby 3.9.8.2, Kirby 3.10.1.1, and Kirby 4.3.1. Please update to one of these or a later version to fix the vulnerability.

In all of the mentioned releases, we have added checks for the languages.create and languages.delete permissions that ensure that users without those permissions cannot perform the respective actions. We have also added a new languages.update permission.

Credits

Thanks to Sebastian Eberlein of JUNO (@SebastianEberlein-JUNO) for reporting the identified issue.

Affected versions

Packagist

Package	Vulnerable	Fixed in
getkirby/cms	`< 3.6.6.6`	`3.6.6.6`
getkirby/cms	`>= 3.7.0, < 3.7.5.5`	`3.7.5.5`
getkirby/cms	`>= 3.8.0, < 3.8.4.4`	`3.8.4.4`
getkirby/cms	`>= 3.9.0, < 3.9.8.2`	`3.9.8.2`
getkirby/cms	`>= 3.10.0, < 3.10.1.1`	`3.10.1.1`
getkirby/cms	`>= 4.0.0, < 4.3.1`	`4.3.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

getkirby/cms Packagist → `3.6.6.6`

composer

composer require getkirby/cms:^3.6.6.6

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): High
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 8.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

Weakness

CWE-863: Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

How to prevent it

Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-41964

Packages

github.com/getkirby/kirby

Timeline

Aug 29, 2024 Published
Jun 17, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-9vx2-j98c-p72w Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling	High	Also affects getkirby/cms
GHSA-6j4c-mgqr-qv76 Kirby: Access to image files outside of the site root via path traversal in the media handling	Medium	Also affects getkirby/cms
GHSA-67mx-6wf2-92xp Kirby: File upload permissions are not checked during processing of chunk data	High	Also affects getkirby/cms
GHSA-rf2p-vh74-7vvh Kirby: System path exposure from error messages in the REST API	Medium	Also affects getkirby/cms
GHSA-r3w8-2c5r-h9j9 Kirby: `pages.access` permission is not checked in the `site/find` REST API route	High	Also affects getkirby/cms
GHSA-89cp-7p28-jffg Kirby: Access to files of top-level drafts is not protected by permissions	Medium	Also affects getkirby/cms
GHSA-whxw-24jc-cwmv Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header	Critical	Also affects getkirby/cms
GHSA-wr9h-4r83-f4v6 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`	High	Also affects getkirby/cms

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor