CVE-2026-42137

MediumCVSS 6.5

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.

Risk Assessment

Users may gain unauthorized access to pages or files that should be protected, potentially leading to data leakage or unauthorized modifications.

Recommendation

Update Kirby to version 4.9.0 or 5.4.0 (depending on the branch used).

Original NVD description (English source)

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.