CVE-2026-42069

MediumCVSS 6.5

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.

Risk Assessment

Unauthorized users can access sensitive configuration and user information.

Recommendation

Update Kirby to version 4.9.0 or 5.4.0, which include the fix.

Original NVD description (English source)

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.