Submeter #997196: getkirby Kirby CMS 5.6.0 Missing Authorization (CWE-862)

Researcher credit: Fernando Viana (GitHub: capivara-research).

This authorization flaw was reproduced locally in Kirby CMS 5.6.0. The case was reported privately to the Kirby maintainers as `GHSA-ch57-pqv8-vm6h` on 2026-09-20 and is currently in triage. No CVE identifier or fix has been assigned to this specific report as of the last authenticated check. Please coordinate this submission with the Kirby maintainers and GitHub as the responsible CNA, and consider CVE assignment for this distinct issue after confirmation. The existing GitHub report should be taken into account to prevent duplicate identifiers.

The affected code path is `config/fields/mixins/options.php` -> `FieldOptions::factory()` -> `Kirby\Option\OptionsQuery::resolve()` in `src/Option/OptionsQuery.php`. A Panel field of type `select`, `multiselect`, `checkboxes` or `radio` can define dynamic options using a blueprint query. `OptionsQuery::resolve()` evaluates the configured query and converts each returned item into option text and value. The audited conversion does not call `isListable()` for returned Page, File or User models before creating the option response. Its defaults render page title and ID, file name and ID, or username and email; custom blueprint text/info templates may render additional values.

Prerequisites: an authenticated Panel user can open a model containing such a field; the blueprint query returns pages, files or users that this role is not permitted to access/list. Sites without these restricted models and query-based fields are not affected by the described condition. The proposed impact is disclosure of option text/value for restricted models. No unauthorized write, privilege escalation or code execution is claimed.

Related but technically different: `GHSA-8r9g-hhm3-5jfh` covered resolution of already stored values in `files`, `pages` and `users` fields, as well as related Panel dialogs and breadcrumbs, and was patched in Kirby 4.9.6/5.6.0. This report concerns the separate dynamic option generation path used by `select`, `multiselect`, `checkboxes` and `radio`; the 5.6.0 source still lacks the per-item listability check in `OptionsQuery::resolve()`. Whether this deserves a separate CVE or an extension of the prior advisory should be decided by the maintainer/CNA after validation.

Verification status: locally reproduced in Kirby 5.6.0. The reproducer at `/tmp/kirby-optionsquery-lab/reproduce.php` creates an in-memory limited Panel user (`[email protected]`), a visible page with a `select` field whose options query is `site.index`, and a restricted page titled `SECRET-MARKER-7392`. Under that same user, the restricted page returned `isListable() === false` and `isAccessible() === false`, while `Kirby\Form\Form::for($visible)->field('related')->toArray()['options']` returned an option with `text: SECRET-MARKER-7392` and `value: secret`. This confirms disclosure in the rendered form field. No HTTP response was captured; the other field types and file/user models have not yet been tested.

Source references:
- Private report: https://github.com/getkirby/kirby/security/advisories/GHSA-ch57-pqv8-vm6h
- Related public advisory: https://github.com/getkirby/kirby/security/advisories/GHSA-8r9g-hhm3-5jfh
- Audited code: https://github.com/getkirby/kirby/blob/3647b786bfd14b99c64a3fcee8644baf88476533/src/Option/OptionsQuery.php#L153-L206
- Field mixin: https://github.com/getkirby/kirby/blob/3647b786bfd14b99c64a3fcee8644baf88476533/config/fields/mixins/options.php#L29-L39
- Security/CNA policy: https://github.com/getkirby/kirby/blob/main/SECURITY.md

• Utilizador: fernando viana (UID 101484)
• Submissão: 24/09/2026 03h22 (há 18 dias)
• Moderação: 11/10/2026 19h56 (18 days later)
• Estado: Aceite
• Entrada VulDB: 416748 [getkirby Kirby até 4.9.5/5.5.3 Dynamic Option Generation OptionsQuery.php OptionsQuery::resolve Elevação de Privilégios]
• Pontos: 17