The vulnerability resides in the OptionsQuery::resolve function of getkirby Kirby’s Dynamic Option Generation component. A crafted request can manipulate the query resolver, allowing an attacker to bypass the intended authorization checks. This bypass can enable unauthorized access to privileged options or actions that are normally restricted to authenticated or privileged users. The flaw is a classic authorization bypass (CWE‑285) due to improper handling of user‑controlled input.

getkirby Kirby versions up to 4.9.5 and 5.5.3 are affected. Upgrading to Kirby 4.9.6 or 5.6.0 removes the vulnerability. The affected component is the Dynamic Option Generation module located in src/Option/OptionsQuery.php. Clients using any of these vulnerable releases should verify the component version and apply the patch promptly.

The CVSS score is 5.3, indicating a moderate severity vulnerability. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a specially crafted request to the OptionsQuery endpoint. Since no authentication is required, the risk to exposed installations is significant for any publicly accessible Kirby instance, warranting timely remediation.