Which versions of Kirby CMS are affected by CVE-2026-42069?

Kirby CMS versions prior to 4.9.0 and 5.4.0 contain an authentication bypass in the admin Panel that allows authenticated users with low-privilege accounts to access sensitive configuration, user…. A patch is available.

How to fix or mitigate CVE-2026-42069?

Within 24 hours: Identify all Kirby CMS instances in your environment and document current versions. Within 7 days: Update all Kirby installations to version 4.9.0 or 5.4.0 (depending on major version in use). Within 30 days: Audit Panel user access logs for unauthorized configuration or user data access; review and reset any user credentials that had low-privilege Panel access during the vulnerability window.

Kirby CMS CVE-2026-42069

Q: What is the CVSS score of CVE-2026-42069?

CVE-2026-42069 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Missing Authorization (CWE-862)

2026-05-04 https://github.com/getkirby/kirby

GHSA-2h7v-4372-f6x2

Authentication Bypass

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 09, 2026 - 04:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 09, 2026 - 04:22 vuln.today

cvss_changed

CVSS changed

May 09, 2026 - 04:22 NVD

7.1 (HIGH)

Source Code Evidence Fetched

May 04, 2026 - 20:31 vuln.today

Analysis Generated

May 04, 2026 - 20:31 vuln.today

DescriptionGitHub Advisory

TL;DR

This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.

This vulnerability is of high severity for affected sites.

Sites using Kirby are *not* affected if they intend all users of the site to be able to list and access the site model and all users and roles, including the content stored within these models. Write actions are *not* affected by this vulnerability as they were gated by permissions before.

----

Introduction

Missing authorization allows authenticated users to perform actions they are not intended to have access to.

The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.

Impact

Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions.

In affected releases, Kirby did not provide permission settings that control the access to the site model as well as to users and user roles. If the site developer disabled all permissions via the wildcard "*": false setting, this only disabled the actions that were explicitly gated by existing permissions.

To be specific, the following permissions were missing in affected releases and have been added in the patches:

site.access
user.access and users.access (for the own user and other users respectively)
user.list and users.list (for the own user and other users respectively)

Access to role information such as the list of existing roles, their names and descriptions as well as their configured permissions were also not gated by user-based permissions.

Patches

The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Please update to one of these or a later version to fix the vulnerability.

In all of the mentioned releases, Kirby has added the missing permissions that are listed in the "Impact" section. The user.access and users.access permissions also take effect on the access to the user's own role and to other roles respectively.

Credits

Kirby thanks @HuajiHD for responsibly reporting the identified issue.

AnalysisAI

Missing authorization in Kirby CMS allows authenticated Panel users to access sensitive site configuration, user data, and role information regardless of configured permission restrictions. Authenticated attackers with low-privilege Panel accounts can enumerate all users, access the site model, and view role configurations including permission settings-even when site administrators explicitly disabled these capabilities via wildcard permission denial ('*': false). Vendor-released patches in versions 4.9.0 and 5.4.0 add missing permission gates for site.access, user.access/users.access, user.list/users.list, and role information. No public exploit identified at time of analysis, but exploitation requires only authenticated Panel access with network connectivity.

Technical ContextAI

Kirby CMS implements role-based access control (RBAC) through user blueprints and model-specific 'options' features to gate CMS actions. The vulnerability stems from CWE-862 (Missing Authorization) where permission checks were never implemented for read operations on critical resources. Specifically, the authorization layer lacked enforcement points for site model access, user enumeration, user detail retrieval, and role metadata (names, descriptions, configured permissions). The wildcard permission setting ('*': false) created a false sense of security-it only disabled actions with existing permission gates, leaving ungated read operations completely open to any authenticated Panel user. This is distinct from authentication bypass; the flaw assumes valid credentials but allows privilege escalation through unauthorized information disclosure. The affected package is distributed via Composer (pkg:composer/getkirby_cms) and impacts both major version branches (4.x through 4.8.0 and 5.0.0 through 5.3.3).

RemediationAI

Upgrade to Kirby CMS 4.9.0 (for 4.x deployments) or 5.4.0 (for 5.x deployments) or any later version. Both releases implement missing authorization checks for site.access, user.access/users.access, user.list/users.list, and role information access. Download from GitHub releases at https://github.com/getkirby/kirby/releases/tag/4.9.0 or https://github.com/getkirby/kirby/releases/tag/5.4.0. The vendor strongly recommends migrating to Kirby 5.x as version 4.x is considered legacy. If immediate patching is not feasible, implement compensating controls: restrict Panel access to only fully trusted users via network-level controls (VPN, IP allowlisting), audit existing Panel user accounts and remove unnecessary accounts, monitor Panel access logs for unusual enumeration patterns, and review role configurations to ensure no sensitive data is stored in user or site model fields accessible via the Panel. Note that these mitigations do not eliminate the vulnerability-they only reduce attack surface by limiting who can authenticate to the Panel. Sites where all Panel users are equally trusted and information sharing is acceptable may defer patching, though this is not recommended for production environments.