PT-2026-37168 · Kirby · Kirby

Offset · Published 2026-05-04 · Updated 2026-05-11 · CVE-2026-42174

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0

Description Missing authorization in the content management system allows authenticated users to create, replace, or delete user avatars even when they lack the necessary permissions to update user information. While the system checks for files.create and files.delete permissions, it fails to verify the user.update or users.update permissions, which are intended to control the authorization to modify a user's own data or the data of other users. This allows users who only possess file permissions to perform unauthorized changes to user profiles.

Recommendations Update to version 4.9.0 or later. Update to version 5.4.0 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-42174

GHSA-39CP-6679-8XV2

Affected Products

Kirby

References · 10

• https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42174 · Security Note
• https://osv.dev/vulnerability/GHSA-39cp-6679-8xv2 · Vendor Advisory
• https://github.com/getkirby/kirby · Note
• https://github.com/getkirby/kirby/releases/tag/5.4.0 · Note
• https://github.com/getkirby/kirby/releases/tag/4.9.0 · Note
• https://twitter.com/VulmonFeeds/status/2053042266990653698 · Twitter Post
• https://twitter.com/CVEnew/status/2053131392897429889 · Twitter Post
• https://twitter.com/CVEarity/status/2053777406838854088 · Twitter Post
• https://t.me/CVEtracker/53202 · Telegram Post