CVE-2026-42137
Kirby is an open-source content management system.
Published May 9, 2026 · updated Jul 24, 2026 · getkirby kirby
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, and permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
May 9, 2026 · NIST NVD
Detected
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, and permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
Jul 24, 2026 · NIST NVD
Updated
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, and permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
Affected
- cpe getkirby/kirbyversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-42137
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-42137
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, and permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
nvd.nist.gov