high7.1
CVE-2026-42137
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
Impact
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | getkirby/cms | <= 4.8.0 | 4.9.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Getkirby | Kirby | before 4.9.0 from 5.0.0 before 5.4.0 |