CVE-2026-42174

MediumCVSS 4.3

Published: 09/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

Kirby CMS before versions 4.9.0 and 5.4.0 does not check user permissions for avatar creation, replacement, and deletion. Any user can modify others' avatars without proper rights.

Risk Assessment

Users can replace others' avatars, potentially leading to profile defacement or misrepresentation.

Recommendation

Update Kirby to version 4.9.0 or 5.4.0, which add permission checks for avatar operations.

Original NVD description (English source)

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.