Kirby Modules

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:medienbaecker:kirby-modules:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorMedienbaecker (60a38761-00c2-53ae-8c83-315ab617c4a3)
ProductKirby Modules (a821e266-e5a3-5e90-8105-e166cc9529fd)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-63092 vulnerable 2026-07-29 01:06:19.294229 kirby-modules License Key Disclosure via modules/activate Dialog
MEDIUM (4.3)
kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialog handler in lib/areas.php returns the complete key via ModulesLicense::readKey() without performing an administrator check, as the dialog is gated only by the access.system permission which defaults to true for all non-admin roles, enabling attackers to use the disclosed key to activate the plugin on arbitrary third-party installations.
Published: 2026-07-21T20:50:18.823Z
Updated: 2026-07-23T18:18:19.099Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.