Is CVE-2026-42051 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42051 being exploited in the wild.

How severe is CVE-2026-42051?

Medium severity, with a CVSS score of 4.3, published 9 May 2026.

Which products and versions are affected?

Kirby = 5.0.0, <= 5.3.3, <= 4.8.0, 5.0.0-5.3.3; Kirby CMS <= 4.8.0, 5.0.0 to 5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.

Is there a fix for CVE-2026-42051?

Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42051 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42051?

Check whether you run Kirby, Kirby CMS or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42051: Kirby CMS information disclosure in system API endpoint

Q: Which products and versions are affected?

Kirby = 5.0.0, <= 5.3.3, <= 4.8.0, 5.0.0-5.3.3; Kirby CMS <= 4.8.0, 5.0.0 to 5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.

Q: Is there a fix for CVE-2026-42051?

Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42051 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42051?

Check whether you run Kirby, Kirby CMS or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42051 · Severity: medium · CVSS 4.3 · Published 2026-05-09

Kirby is an open-source content management system used to build and manage websites. A security flaw in the system's internal programming interface allows logged-in users to view sensitive license information and the exact version of the software being used, even if they do not have permission to see system settings. This information could be used by a malicious actor to identify specific weaknesses in the site for further attacks.

Technologies: Kirby, Kirby CMS, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-42051 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42051 being exploited in the wild.
How severe is CVE-2026-42051?: Medium severity, with a CVSS score of 4.3, published 9 May 2026.
Which products and versions are affected?: Kirby <= 4.8.0, >= 5.0.0, <= 5.3.3, <= 4.8.0, 5.0.0-5.3.3; Kirby CMS <= 4.8.0, 5.0.0 to 5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.
Is there a fix for CVE-2026-42051?: Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42051 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42051?: Check whether you run Kirby, Kirby CMS or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getkirby/cms (Packagist): upgrade to 4.9.0 or later
```
composer require getkirby/cms:^4.9.0
```

Technical details

A missing authorization check in the Kirby CMS REST API allows authenticated users to access sensitive system data. Specifically, the `/api/system` endpoint returns the installed Kirby version and license details (status, type, and code) to any authenticated user, bypassing the 'access.system' permission check defined in user blueprints. While this does not allow for direct data modification, it facilitates reconnaissance by providing attackers with version-specific details necessary to plan subsequent exploits. The issue is resolved in versions 4.9.0 and 5.4.0 by implementing a permission check on the version and license properties within the API response.

Affected products

Kirby Kirby CMS <= 4.8.0, 5.0.0 to 5.3.3

Identifiers

CVE-2026-42051
GHSA-x68m-c7jf-2572

Timeline

2026-04-23: patched: Versions 4.9.0 and 5.4.0 released
2026-04-23: advisory: GitHub Security Advisory GHSA-x68m-c7jf-2572 published
2026-05-09: disclosed: CVE-2026-42051 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.