Executive brief
A vulnerability in the kirby-modules plugin for the Kirby CMS allows any logged-in user to view the site's commercial license key. This key is intended to be restricted to administrators, but a flaw in the software's permission checks makes it visible to lower-privileged users. An attacker could steal this key to illegally activate the software on other websites, potentially leading to licensing disputes or reputational damage.
Technical details
An information disclosure vulnerability exists in kirby-modules through version 5.5.7 due to missing authorization checks in the 'modules/activate' dialog endpoint. The handler in 'lib/areas.php' calls 'ModulesLicense::readKey()' and returns the plaintext license key to any user with the 'access.system' permission. Because this permission defaults to true for non-administrator roles, any authenticated Panel user can retrieve the key via a simple GET request. This allows attackers to exfiltrate commercial license keys for use on unauthorized installations. The issue is fixed in commit 315417e by obfuscating the key for non-admin users.
Affected products
- medienbaecker kirby-modules through 5.5.7
Timeline
- 2026-07-21: advisory: NVD and VulnCheck published the advisory.
- 2026-07-21: disclosed
- 2026-07-21: patched: Fixed in commit 315417e.