The vulnerability in kirby-modules allows an authenticated user of the Kirby Panel to send a simple GET request to the modules/activate dialog endpoint and receive the full commercial license key in plaintext. The flaw arises because the handler performs no administrator check and relies only on a permission that is granted to non-admin roles by default. Obtaining the license key enables the attacker to activate the licensed plugin on their own or on third-party installations, effectively abetting license reuse or abuse.

All installations of the kirby-modules plugin through version 5.5.7 are impacted. The fix resides in commit 315417e, and any release after that commit is considered safe.

The CVSS score of 5.3 classifies the issue as moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA KEV. Exploitation requires valid panel credentials and the presence of the access.system permission, which most non-admin users possess by default. An attacker who compromises an authenticated user can thus retrieve the license key without further access.