CVE-2026-42174: Kirby CMS missing authorization for user avatar management

CVE-2026-42174 · Severity: medium · CVSS 4.3 · Published 2026-05-09

Kirby, an open-source content management system, contains a flaw where user avatar management is not properly restricted by administrative permissions. This allows authenticated users who should not have permission to modify user profiles to create, replace, or delete avatars for themselves or others. While this does not grant full control over the system, it allows unauthorized modification of user-related content.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-42174 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42174 being exploited in the wild.
How severe is CVE-2026-42174?
Medium severity, with a CVSS score of 4.3, published 9 May 2026.
Which products and versions are affected?
Kirby <= 4.8.0, >= 5.0.0, <= 5.3.3, <= 4.8.0, 5.0.0 to 5.3.3, <= 4.8.0, 5.0.0-5.3.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.0.
Is there a fix for CVE-2026-42174?
Yes. getkirby/cms (Packagist): upgrade to 4.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42174 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42174?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.0 or later
    composer require getkirby/cms:^4.9.0

Technical details

A missing authorization vulnerability (CWE-862) exists in Kirby CMS prior to versions 4.9.0 and 5.4.0. The software failed to gate avatar-related actions (creation, replacement, and deletion) behind the 'user.update' or 'users.update' permission checks. Instead, it relied solely on general file permissions ('files.create', 'files.delete'). This allows an authenticated user with basic file permissions to modify user avatars even if their role explicitly prohibits updating user information. The fix introduces mandatory 'user.update'/'users.update' permission checks for all avatar operations.

Affected products

  • Kirby Kirby CMS <= 4.8.0, 5.0.0 to 5.3.3

Identifiers

  • CVE-2026-42174
  • GHSA-39cp-6679-8xv2

Timeline

  • 2026-04-23: patched: Versions 4.9.0 and 5.4.0 released.
  • 2026-04-23: advisory: GitHub Security Advisory GHSA-39cp-6679-8xv2 published.
  • 2026-05-09: disclosed: CVE-2026-42174 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.