Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-42137

Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

getkirby kirby

  • < 4.9.0affected
  • >= 5.0.0, < 5.4.0affected

References