{"items":[{"id":"NVI-00002051","kind":"vulnerability","title":"Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-43qq-qw4x-28f8","CVE-2022-39314"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-337cc101c8273fb4f79bb037b3f600dc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.428%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.37116. Missing scores are unknown.","source_id":"sr-337cc101c8273fb4f79bb037b3f600dc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-09508f2002569372e77f60bf04e0ccb6","url":"https://github.com/advisories/GHSA-43qq-qw4x-28f8","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-43qq-qw4x-28f8","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.663Z"},{"id":"sr-337cc101c8273fb4f79bb037b3f600dc","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2022-39314","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.5.0; fixed 3.5.8.2"]},{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.2"]},{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.1"]},{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.1"]}],"null_published_at":"2026-10-31T22:27:15.286Z","source_updated_at":"2026-02-03T03:03:33.739Z","source_disclosed_at":"2022-10-18T21:14:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:41:49.663Z"},{"id":"NVI-00002051","kind":"vulnerability","title":"Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-43qq-qw4x-28f8","CVE-2022-39314"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-09508f2002569372e77f60bf04e0ccb6","url":"https://github.com/advisories/GHSA-43qq-qw4x-28f8","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-43qq-qw4x-28f8","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:49.663Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.5.0; fixed 3.5.8.2"]},{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.2"]},{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.1"]},{"certainty":"source_listed","source_ids":["sr-09508f2002569372e77f60bf04e0ccb6"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects you if you are using the `code` or `password-reset` auth method with the `auth.methods` option. It can only be successfully exploited under server configuration conditions outside of the attacker's control.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nUnder normal circumstances, entering an invalid email address results in a \"fake\" login code form that looks exactly like the one of an existing user (unless debugging is enabled). However, the code that handles the creation of a code challenge (for code-based login or password","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.1"]}],"null_published_at":"2026-10-31T21:53:28.063Z","source_updated_at":"2026-02-03T03:03:33.739Z","source_disclosed_at":"2022-10-18T21:14:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:49.663Z"}],"next_cursor":null,"snapshot_revision":"42594"}