CVE-2026-42137

UNKNOWN 0.0

Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.

CWE	CWE-862 CWE-863
Vendor	getkirby
Product	kirby
Published	May 9, 2026

Stay Ahead of the Next One

Get instant alerts for getkirby kirby

Be the first to know when new unknown vulnerabilities affecting getkirby kirby are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getkirby / kirby

< 4.9.0 >= 5.0.0, < 5.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getkirby/kirby/security/advisories/GHSA-85x2-r8xv-ww8c github.com: https://github.com/getkirby/kirby/releases/tag/4.9.0 github.com: https://github.com/getkirby/kirby/releases/tag/5.4.0