# CVE-2026-42137: Kirby CMS incorrect authorization in Panel and REST API permissions

Source: https://junglewise.ai/threats/cve-2026-42137-kirby-cms-incorrect-authorization-in-panel-and-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-09. Updated: 2026-05-18  
License: CC BY 4.0 with a link back

CVE-2026-42137 · Severity: medium · CVSS 6.5 · Published 2026-05-09

Kirby, an open-source content management system, contains a vulnerability where certain access controls for pages and files are not consistently enforced. This allows authenticated users, such as staff with limited accounts, to view sensitive files or page listings they are officially restricted from seeing. While attackers cannot modify or delete content through this flaw, it can lead to the exposure of private internal data or intellectual property.

Technologies: [Kirby](https://junglewise.ai/threats/technologies/kirby), [getkirby/cms (Packagist)](https://junglewise.ai/threats/technologies/getkirby-cms). Vendors: [Kirby](https://junglewise.ai/threats/vendors/kirby), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-42137 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42137 being exploited in the wild.

**How severe is CVE-2026-42137?** Medium severity, with a CVSS score of 6.5, published 9 May 2026.

**Which products and versions are affected?** Kirby < 4.9.0, 5.0.0 to < 5.4.0, <= 4.8.0, 5.0.0-5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.

**Is there a fix for CVE-2026-42137?** Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42137 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42137?** Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getkirby/cms (Packagist): upgrade to 4.9.0 or later

  ```sh
  composer require getkirby/cms:^4.9.0
  ```


## Technical details

Kirby CMS is vulnerable to missing and incorrect authorization checks (CWE-862, CWE-863) within its Panel and REST API. Specifically, the 'pages.access', 'pages.list', 'files.access', and 'files.list' permissions are not consistently applied when filtering collections or related models. An authenticated attacker with low privileges can exploit this to view restricted page metadata, file listings, and parent/sibling relationships that should be hidden based on their role's blueprint configuration. The vulnerability affects the REST API's handling of children, drafts, and search routes, as well as the Panel's 'changes' dialog and image previews. The issue is resolved in versions 4.9.0 and 5.4.0 by implementing consistent '$model->isListable()' checks.

## Affected products

- Kirby Kirby CMS < 4.9.0, 5.0.0 to < 5.4.0

## Identifiers

- CVE-2026-42137
- GHSA-85x2-r8xv-ww8c

## Timeline

- 2026-04-23: patched: Versions 4.9.0 and 5.4.0 released
- 2026-04-23: advisory: GitHub Security Advisory GHSA-85x2-r8xv-ww8c published
- 2026-05-09: disclosed: CVE-2026-42137 published to NVD

## References

- [https://github.com/getkirby/kirby/releases/tag/4.9.0](https://github.com/getkirby/kirby/releases/tag/4.9.0)
- [https://github.com/getkirby/kirby/releases/tag/5.4.0](https://github.com/getkirby/kirby/releases/tag/5.4.0)
- [https://github.com/getkirby/kirby/security/advisories/GHSA-85x2-r8xv-ww8c](https://github.com/getkirby/kirby/security/advisories/GHSA-85x2-r8xv-ww8c)

## Related threats

- [Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes)
- [Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory)
- [Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads)
- [Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages)
- [Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags)