{"items":[{"id":"NVI-00003596","kind":"vulnerability","title":"Kirby CMS vulnerable to user enumeration in the brute force protection","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c27j-76xg-6x4f","CVE-2022-39315"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-37950f7bb4f887f4af2b1a6540050af1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T04:58:07.710Z","value":"6.5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-a958cfc5c69d7a2f25c37b33121a1537"},{"kind":"CVSS","as_of":"2026-06-17T04:58:07.710Z","value":"5.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-a958cfc5c69d7a2f25c37b33121a1537"},{"kind":"EPSS","as_of":"2026-11-01T12:00:16.000Z","value":"0.790%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.56284. Missing scores are unknown.","source_id":"sr-37950f7bb4f887f4af2b1a6540050af1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-444d83819704530d5655246ec0cafea5","url":"https://github.com/advisories/GHSA-c27j-76xg-6x4f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c27j-76xg-6x4f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.692Z"},{"id":"sr-a958cfc5c69d7a2f25c37b33121a1537","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39315","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2022-39315","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T23:14:33.801Z"},{"id":"sr-37950f7bb4f887f4af2b1a6540050af1","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2022-39315","publisher":"FIRST EPSS","observed_at":"2026-11-01T14:27:48.610Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.5.8.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.1"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.1"]}],"null_published_at":"2026-11-08T19:53:48.749Z","source_updated_at":"2024-02-16T07:57:40.406Z","source_disclosed_at":"2022-10-18T21:16:27.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.692Z"},{"id":"NVI-00003596","kind":"vulnerability","title":"Kirby CMS vulnerable to user enumeration in the brute force protection","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c27j-76xg-6x4f","CVE-2022-39315"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-bec1961a8cfbe5b0d450e7744b6e9d81"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T04:58:07.710Z","value":"6.5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-a958cfc5c69d7a2f25c37b33121a1537"},{"kind":"CVSS","as_of":"2026-06-17T04:58:07.710Z","value":"5.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-a958cfc5c69d7a2f25c37b33121a1537"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.790%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.56284. Missing scores are unknown.","source_id":"sr-bec1961a8cfbe5b0d450e7744b6e9d81"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-444d83819704530d5655246ec0cafea5","url":"https://github.com/advisories/GHSA-c27j-76xg-6x4f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c27j-76xg-6x4f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.692Z"},{"id":"sr-a958cfc5c69d7a2f25c37b33121a1537","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39315","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2022-39315","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T23:14:33.801Z"},{"id":"sr-bec1961a8cfbe5b0d450e7744b6e9d81","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2022-39315","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.5.8.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.1"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.1"]}],"null_published_at":"2026-11-06T21:03:48.001Z","source_updated_at":"2024-02-16T07:57:40.406Z","source_disclosed_at":"2022-10-18T21:16:27.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:10.692Z"},{"id":"NVI-00003596","kind":"vulnerability","title":"Kirby CMS vulnerable to user enumeration in the brute force protection","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-c27j-76xg-6x4f","CVE-2022-39315"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a958cfc5c69d7a2f25c37b33121a1537"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-17T04:58:07.710Z","value":"6.5 MEDIUM (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-a958cfc5c69d7a2f25c37b33121a1537"},{"kind":"CVSS","as_of":"2026-06-17T04:58:07.710Z","value":"5.3 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-a958cfc5c69d7a2f25c37b33121a1537"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-444d83819704530d5655246ec0cafea5","url":"https://github.com/advisories/GHSA-c27j-76xg-6x4f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c27j-76xg-6x4f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.692Z"},{"id":"sr-a958cfc5c69d7a2f25c37b33121a1537","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39315","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2022-39315","publisher":"NIST National Vulnerability Database","observed_at":"2026-10-31T23:14:33.801Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.5.8.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.1"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.1"]}],"null_published_at":"2026-11-06T15:18:17.668Z","source_updated_at":"2024-02-16T07:57:40.406Z","source_disclosed_at":"2022-10-18T21:16:27.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:10.692Z"},{"id":"NVI-00003596","kind":"vulnerability","title":"Kirby CMS vulnerable to user enumeration in the brute force protection","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-c27j-76xg-6x4f","CVE-2022-39315"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-444d83819704530d5655246ec0cafea5","url":"https://github.com/advisories/GHSA-c27j-76xg-6x4f","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-c27j-76xg-6x4f","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:10.692Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.5.8.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.2"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.1"]},{"certainty":"source_listed","source_ids":["sr-444d83819704530d5655246ec0cafea5"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be exploited for targeted attacks because the attack does not scale to brute force.\n\n----\n\n### Introduction\n\nUser enumeration is a type of vulnerability that allows attackers to confirm which users are registered in a Kirby installation. This information can be abused for social engineering attacks against users of the site or to find out the organizational structure of the company.\n\nUser enumeration attacks are performed by entering an existing and a non-existing user into the email address field of the login form. If the system returns a different response or behaves differently depending on whether the user exists, the attacker can enter unknown email addresses and use the different behavior as a clue for the (non-)existing user.\n\n### Impact\n\nKirby comes with a built-in brute force protection. By default, it will prevent further login attempts after 10 failed logins from a single IP address or of a single existing user. After every failed login attempt, Kirby inserts a random delay between one millisecond and two seconds to make automate","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.1"]}],"null_published_at":"2026-10-31T22:12:48.023Z","source_updated_at":"2024-02-16T07:57:40.406Z","source_disclosed_at":"2022-10-18T21:16:27.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:10.692Z"}],"next_cursor":null,"snapshot_revision":"42594"}