PT-2026-37164 · Kirby · Kirby

0X-Bala + 1 · Published 2026-05-04 · Updated 2026-05-11 · CVE-2026-42051

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0

Description Missing authorization in the system API endpoint allows authenticated users to access sensitive information. Specifically, the '/api/system' endpoint leaks the installed Kirby version and the status, type, and code of the installed license to users who lack the access.system permission. This information can be utilized by malicious actors during reconnaissance to plan further attacks.

Recommendations Update to version 4.9.0 or later. Update to version 5.4.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-42051

GHSA-X68M-C7JF-2572

Affected Products

Kirby

References · 11

• https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42051 · Security Note
• https://osv.dev/vulnerability/GHSA-x68m-c7jf-2572 · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/releases/tag/5.4.0 · Note
• https://github.com/getkirby/kirby/releases/tag/4.9.0 · Note
• https://twitter.com/CVEnew/status/2053131394793246800 · Twitter Post
• https://t.me/CVEtracker/53200 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053049946165719261 · Twitter Post
• https://twitter.com/CVEarity/status/2053769076703699139 · Twitter Post
• https://t.me/cveNotify/162847 · Telegram Post