CVE-2026-63092

Name of the Vulnerable Software and Affected Versions kirby-modules versions prior to 5.5.8

Description An information disclosure issue allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key. This occurs when a GET request is sent to the 'modules/activate' dialog endpoint. The activate dialog handler in lib/areas.php uses the ModulesLicense::readKey() function to return the key without verifying if the user has administrator privileges. Because the dialog is only restricted by the access.system permission, which is enabled by default for all non-admin roles, unauthorized users can obtain the key and use it to activate the plugin on other installations.

Recommendations Update kirby-modules to version 5.5.8 or later. Restrict the access.system permission for non-administrator roles to prevent unauthorized access to system dialogs.