medium4.3
CVE-2026-42051
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
Impact
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getkirby/cms | <= 4.8.0 | 4.9.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getkirby | Kirby | before 4.9.0 from 5.0.0 before 5.4.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-x68m-c7jf-2572
- https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572
- https://github.com/getkirby/kirby/releases/tag/4.9.0
- https://github.com/getkirby/kirby/releases/tag/5.4.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-42051