Executive brief
Kirby, an open-source content management system, contains a flaw where user avatar management is not properly restricted by administrative permissions. This allows authenticated users who should not have permission to modify user profiles to create, replace, or delete avatars for themselves or others. While this does not grant full control over the system, it allows unauthorized modification of user-related content.
Technical details
A missing authorization vulnerability (CWE-862) exists in Kirby CMS prior to versions 4.9.0 and 5.4.0. The software failed to gate avatar-related actions (creation, replacement, and deletion) behind the 'user.update' or 'users.update' permission checks. Instead, it relied solely on general file permissions ('files.create', 'files.delete'). This allows an authenticated user with basic file permissions to modify user avatars even if their role explicitly prohibits updating user information. The fix introduces mandatory 'user.update'/'users.update' permission checks for all avatar operations.
Affected products
- Kirby Kirby CMS <= 4.8.0, 5.0.0 to 5.3.3
Timeline
- 2026-04-23: patched: Versions 4.9.0 and 5.4.0 released.
- 2026-04-23: advisory: GitHub Security Advisory GHSA-39cp-6679-8xv2 published.
- 2026-05-09: disclosed: CVE-2026-42174 published to NVD.