PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42137 getkirby CVE debrief

CVE-2026-42137 is a high-severity authorization flaw in Kirby CMS where `pages.access/list` and `files.access/list` permissions were not consistently enforced in the Panel and REST API. In affected versions before 4.9.0 and 5.4.0, that can expose page and file listing data to users who should not have access.

Vendor
getkirby
Product
kirby
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Kirby site operators, application teams, and maintainers who rely on Panel or REST API authorization for page and file access should review this immediately, especially where low-privilege users can interact with content management features.

Technical summary

The official NVD record describes this as an access-control problem mapped to CWE-862 and CWE-863. The published CVSS 4.0 vector is `AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N`, indicating a network-reachable issue that requires some privileges but primarily affects confidentiality. The GitHub Security Advisory and Kirby release tags identify the fixes in 4.9.0 and 5.4.0.

Defensive priority

High — prioritize upgrade if your Kirby deployment exposes the Panel or REST API and depends on `pages.access/list` or `files.access/list` for access control.

Recommended defensive actions

  • Upgrade Kirby to a fixed release: 4.9.0, 5.4.0, or later depending on your branch.
  • Review any Panel and REST API workflows that depend on page/file listing permissions.
  • Verify that custom roles, plugins, and integrations do not assume these permissions are always enforced elsewhere.
  • Temporarily restrict access to the Panel and REST API to trusted users while you validate the fix.
  • Check for unexpected page or file listing access in logs and access reviews after remediation.

Evidence notes

The source corpus provides an official NVD update timestamp of 2026-05-09 and references three official GitHub links: Kirby release tag 4.9.0, Kirby release tag 5.4.0, and GitHub Security Advisory GHSA-85x2-r8xv-ww8c. The NVD metadata lists the issue as `Received` and includes CVSS 4.0 vector `AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N` with CWE-862 and CWE-863.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42137 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42137

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42137 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42137

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.