CVE-2026-63092: kirby-modules Information Disclosure Flaw

CVE-2026-63092 Overview

CVE-2026-63092 is an information disclosure vulnerability in the kirby-modules plugin through version 5.5.7. The flaw allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key via the modules/activate dialog endpoint. The plugin's activate dialog handler in lib/areas.php returns the complete key through ModulesLicense::readKey() without verifying administrator status. The dialog is gated only by the access.system permission, which defaults to true for all non-admin roles. The issue is tracked as a missing authorization weakness [CWE-862] and is fixed in commit 315417e.

Critical Impact
Any low-privileged Panel user can exfiltrate the commercial license key and reuse it to activate the plugin on arbitrary third-party installations.

Affected Products

kirby-modules plugin versions through 5.5.7
Kirby CMS installations using the medienbaecker/modules plugin
Sites where non-admin roles retain the default access.system permission

Discovery Timeline

2026-07-21 - CVE-2026-63092 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63092

Vulnerability Analysis

The kirby-modules plugin exposes a Panel dialog at the modules/activate route that renders the commercial license key back to the requesting user. The dialog handler in lib/areas.php calls ModulesLicense::readKey() and passes the returned value directly into the dialog props under license.code. No role check confirms that the requester is an administrator before returning the plaintext key.

Access to the dialog relies solely on the access.system permission. In Kirby's default permission model, this flag is granted to all non-admin roles unless an operator explicitly revokes it. Any authenticated Panel user with a standard role can therefore issue a GET request to the dialog endpoint and read the full license key from the JSON response.

Once obtained, the key can be used to activate the plugin on unrelated Kirby installations, undermining the plugin's commercial licensing model and exposing the license owner to compliance and revocation risks.

Root Cause

The root cause is missing authorization at the dialog handler. The code assumes the access.system permission is sufficient to view administrative artifacts, but that permission is not restricted to admin roles by default. The handler returns the raw key rather than an obfuscated representation for non-admins.

Attack Vector

An attacker with any authenticated Panel account sends a GET request to the modules/activate dialog endpoint. The response body includes the plaintext license key in the license.code property, which the attacker extracts and reuses on other Kirby installations.

php

// Patch in lib/areas.php - obfuscate license key for non-admins
            $key = ModulesLicense::readKey();

            if ($key) {
+              $obfuscated = $kirby->user()?->isAdmin() !== true;
              $version = $kirby->plugin('medienbaecker/modules')->version();
              return [
                'component' => 'k-modules-license-dialog',
                'props' => [
                  'license' => [
-                    'code'    => $key,
+                    'code'    => ModulesLicense::code($obfuscated),
                    'version' => $version ? 'v' . $version : null,
                  ],
                  'cancelButton' => false,

Source: GitHub Commit 315417e

Detection Methods for CVE-2026-63092

Indicators of Compromise

GET requests to the modules/activate dialog endpoint originating from non-admin Panel sessions.
Panel access log entries that show access.system dialog fetches from user roles other than admin.
Reuse of the same commercial license key on Kirby installations not owned by the license holder.

Detection Strategies

Review Kirby Panel request logs for accesses to the modules activation dialog and correlate the requesting user's role.
Inspect web server access logs for the dialog path and flag requests where the authenticated session lacks admin privileges.
Monitor plugin telemetry or vendor activation records for concurrent activations of the same license key across distinct hostnames.

Monitoring Recommendations

Alert on any HTTP 200 response from the modules/activate dialog endpoint where the session role is not admin.
Track the installed version of the medienbaecker/modules plugin across managed Kirby sites and flag versions at or below 5.5.7.
Audit role definitions periodically for the access.system permission and record deviations from least privilege.

How to Mitigate CVE-2026-63092

Immediate Actions Required

Update the kirby-modules plugin to the version containing commit 315417e or later.
Rotate the commercial license key with the vendor if any non-admin account had Panel access on a vulnerable installation.
Revoke access.system from non-admin roles until the patched plugin version is deployed.

Patch Information

The fix is available in commit 315417e of the medienbaecker/kirby-modules repository. The patch introduces an $obfuscated flag derived from $kirby->user()?->isAdmin() and replaces the direct $key value with a call to ModulesLicense::code($obfuscated), ensuring only administrators receive the plaintext key. See the GitHub commit and the VulnCheck Security Advisory for details.

Workarounds

Restrict the access.system permission to admin roles only in the site's blueprints/users role definitions.
Temporarily disable the medienbaecker/modules plugin on installations where the patch cannot be applied immediately.
Limit Panel access to trusted administrators through network controls or SSO group restrictions until the update is deployed.

bash

# Example role blueprint override to remove access.system from a non-admin role
# site/blueprints/users/editor.yml
title: Editor
permissions:
  access:
    system: false