CVE-2026-42174

UNKNOWN 0.0

Kirby: User avatar creation, replacement and deletion are not gated by user update permissions

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.

CWE	CWE-862
Vendor	getkirby
Product	kirby
Published	May 9, 2026

Stay Ahead of the Next One

Get instant alerts for getkirby kirby

Be the first to know when new unknown vulnerabilities affecting getkirby kirby are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getkirby / kirby

< 4.9.0 >= 5.0.0, < 5.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2 github.com: https://github.com/getkirby/kirby/releases/tag/4.9.0 github.com: https://github.com/getkirby/kirby/releases/tag/5.4.0