CVE-2026-42137 Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API

What is CVE-2026-42137?

CVE-2026-42137 is a high-severity missing authorization vulnerability in getkirby kirby, published on 9 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.

Weakness: CWE-863, CWE-862

Which versions are affected by CVE-2026-42137?

4 open source packages ship an affected version, including getkirby/cms. It affects 1 product.

Products include Getkirby Kirby.

How do I fix CVE-2026-42137?

Upgrade getkirby/cms to a fixed version for your release line: 4.9.0 or 5.4.0.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-42137 being exploited?

There is no known exploitation of CVE-2026-42137 in the wild and no public exploit code.

Other vulnerabilities in getkirby kirby

• CVE-2024-26483 Kirby vulnerable to unrestricted file upload of user avatar images High 8.8
• CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS High 8.1
• CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering High 7.6
• CVE-2021-29460 Cross-site scripting (XSS) from unsanitized uploaded SVG files High 7.6
• CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-85x2-r8xv-ww8c.