CVE-2026-21896

Kirby (CMS) versions 5.0.0–5.2.1 contain missing permission checks in the content changes API. This allows attackers with Panel access to manipulate the changes version or content fields, potentially creating editing locks, injecting content, or discarding edits across any model, when user permis...