← Database

CVE-2026-42137

MEDIUM CVSS: 6.5 Published: 2026-05-09 Modified: 2026-07-24

Description

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.

Affected Platforms

Getkirby Kirby

Weakness Type

CWE-862, CWE-863

References