CVE-2026-42137 — Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the…
Published: 2026-05-09 · CVSS: 7.1 · CVSS 4.0
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7