Kirby · Kirby · CVE-2026-42051
**Name of the Vulnerable Software and Affected Versions**
Kirby versions prior to 4.9.0
Kirby versions prior to 5.4.0
**Description**
Missing authorization in the system API endpoint allows authenticated users to access sensitive information. Specifically, the '/api/system' endpoint leaks the installed Kirby version and the status, type, and code of the installed license to users who lack the `access.system` permission. This information can be utilized by malicious actors during reconnaissance to plan further attacks.
**Recommendations**
Update to version 4.9.0 or later.
Update to version 5.4.0 or later.