{"id":"CVE-2026-42174","state":"PUBLISHED","title":"Kirby: User avatar creation, replacement and deletion are not gated by user update permissions","description":"Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.","publishedAt":"2026-05-09T03:39:06.016Z","updatedAt":"2026-05-11T17:41:44.554Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["getkirby kirby"],"affected":[{"vendor":"getkirby","product":"kirby","versions":[{"version":"< 4.9.0","status":"affected"},{"version":">= 5.0.0, < 5.4.0","status":"affected"}]}],"references":["https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2","https://github.com/getkirby/kirby/releases/tag/4.9.0","https://github.com/getkirby/kirby/releases/tag/5.4.0"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/42xxx/CVE-2026-42174.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-42174","state":"PUBLISHED","datePublished":"2026-05-09T03:39:06.016Z","dateUpdated":"2026-05-11T17:41:44.554Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-04-25T01:53:21.582Z"},"containers":{"cna":{"title":"Kirby: User avatar creation, replacement and deletion are not gated by user update permissions","descriptions":[{"lang":"en","value":"Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0."}],"affected":[{"vendor":"getkirby","product":"kirby","versions":[{"version":"< 4.9.0","status":"affected"},{"version":">= 5.0.0, < 5.4.0","status":"affected"}]}],"references":[{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2","name":"https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/getkirby/kirby/releases/tag/4.9.0","name":"https://github.com/getkirby/kirby/releases/tag/4.9.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/getkirby/kirby/releases/tag/5.4.0","name":"https://github.com/getkirby/kirby/releases/tag/5.4.0","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862: Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-09T03:39:06.016Z"},"source":{"advisory":"GHSA-39cp-6679-8xv2","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-11T17:41:35.070100Z","id":"CVE-2026-42174","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-11T17:41:44.554Z"}}]}}}