PT-2026-37165 · Kirby · Kirby

Huajihd · Published 2026-05-04 · Updated 2026-05-11 · CVE-2026-42069

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0

Description Missing authorization allows authenticated Panel users to access site, user, and role information without proper permission gating. This occurs because permission settings for the site model, users, and user roles were not implemented, meaning that even if a developer disabled all permissions using the "*": false setting, these specific actions remained accessible. The affected areas include the ability to list and access the site model, as well as viewing user and role details, including names, descriptions, and configured permissions. Specifically, the missing permissions were site.access, user.access, users.access, user.list, and users.list.

Recommendations Update to version 4.9.0 or later. Update to version 5.4.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-42069

GHSA-2H7V-4372-F6X2

Affected Products

Kirby

References · 11

• https://github.com/getkirby/kirby/security/advisories/GHSA-2h7v-4372-f6x2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2h7v-4372-f6x2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42069 · Security Note
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/releases/tag/4.9.0 · Note
• https://github.com/getkirby/kirby/releases/tag/5.4.0 · Note
• https://twitter.com/CVEarity/status/2053771853702017534 · Twitter Post
• https://t.me/CVEtracker/53199 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053047386482602084 · Twitter Post
• https://t.me/cveNotify/162848 · Telegram Post
• https://twitter.com/CVEnew/status/2053131396059914501 · Twitter Post