Is CVE-2026-42137 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42137 being exploited in the wild.

How severe is CVE-2026-42137?

Medium severity, with a CVSS score of 6.5, published 9 May 2026.

Which products and versions are affected?

Kirby < 4.9.0, 5.0.0 to < 5.4.0, <= 4.8.0, 5.0.0-5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.

Is there a fix for CVE-2026-42137?

Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42137 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42137?

Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42137: Kirby CMS incorrect authorization in Panel and REST API permissions

Q: Which products and versions are affected?

Kirby < 4.9.0, 5.0.0 to < 5.4.0, <= 4.8.0, 5.0.0-5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.

Q: Is there a fix for CVE-2026-42137?

Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42137 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42137?

Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42137 · Severity: medium · CVSS 6.5 · Published 2026-05-09

Kirby, an open-source content management system, contains a vulnerability where certain access controls for pages and files are not consistently enforced. This allows authenticated users, such as staff with limited accounts, to view sensitive files or page listings they are officially restricted from seeing. While attackers cannot modify or delete content through this flaw, it can lead to the exposure of private internal data or intellectual property.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-42137 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42137 being exploited in the wild.
How severe is CVE-2026-42137?: Medium severity, with a CVSS score of 6.5, published 9 May 2026.
Which products and versions are affected?: Kirby < 4.9.0, 5.0.0 to < 5.4.0, <= 4.8.0, 5.0.0-5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.
Is there a fix for CVE-2026-42137?: Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42137 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42137?: Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getkirby/cms (Packagist): upgrade to 4.9.0 or later
```
composer require getkirby/cms:^4.9.0
```

Technical details

Kirby CMS is vulnerable to missing and incorrect authorization checks (CWE-862, CWE-863) within its Panel and REST API. Specifically, the 'pages.access', 'pages.list', 'files.access', and 'files.list' permissions are not consistently applied when filtering collections or related models. An authenticated attacker with low privileges can exploit this to view restricted page metadata, file listings, and parent/sibling relationships that should be hidden based on their role's blueprint configuration. The vulnerability affects the REST API's handling of children, drafts, and search routes, as well as the Panel's 'changes' dialog and image previews. The issue is resolved in versions 4.9.0 and 5.4.0 by implementing consistent '$model->isListable()' checks.

Affected products

Kirby Kirby CMS < 4.9.0, 5.0.0 to < 5.4.0

Identifiers

CVE-2026-42137
GHSA-85x2-r8xv-ww8c

Timeline

2026-04-23: patched: Versions 4.9.0 and 5.4.0 released
2026-04-23: advisory: GitHub Security Advisory GHSA-85x2-r8xv-ww8c published
2026-05-09: disclosed: CVE-2026-42137 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.