High
Kirby: Read access to site, user and role information is not gated by permissions
Type: advisorySources: OSV
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-42069
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 01:54 UTC · Revision 1
Source evidence
Kirby: Read access to site, user and role information is not gated by permissions
core-osv · Original sourcePublished 9 May 2026, 03:35 UTC
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.
osv:CVE-2026-42069
Complete source record
{
"id": "20bba395d038f68f95894619afc492cc36fd0db75c50b4a9866e82e183ea9c47",
"url": "https://osv.dev/vulnerability/CVE-2026-42069",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Kirby: Read access to site, user and role information is not gated by permissions",
"summary": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.",
"evidence": "osv:CVE-2026-42069",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-42069",
"aliases": [
"CVE-2026-42069",
"GHSA-2h7v-4372-f6x2"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/getkirby/kirby",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d952dfc0a890979c863ec5fa11660e37400f0f4c"
},
{
"introduced": "2ff182ba39ddea19fa1615bd3733f734b5e53842"
},
{
"fixed": "80061614af90387da8b8ff9d92b390050a5f958f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.9.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.4.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "d952dfc0a890979c863ec5fa11660e37400f0f4c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "4.9.0"
},
{
"range": [
{
"fixed": "80061614af90387da8b8ff9d92b390050a5f958f"
}
],
"source": "REFERENCES_TAG",
"original_tag": "5.4.0"
}
]
}
}
],
"versions": [
"4.8.0",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.3",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.1",
"5.1.0",
"5.0.4",
"5.0.3",
"5.0.2",
"5.0.1",
"5.0.0",
"4.7.2",
"4.7.1",
"4.7.0",
"4.6.1",
"4.6.0",
"4.5.0",
"4.4.1",
"4.4.0",
"4.3.1",
"4.3.0",
"4.2.0",
"4.1.2",
"4.1.1",
"4.1.0",
"3.9.8",
"4.0.3",
"4.0.2",
"4.0.1",
"4.0.0",
"3.9.7",
"3.9.6.1",
"3.9.6",
"3.8.4",
"3.9.6-rc.1",
"3.9.5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.3",
"3.8.2",
"3.8.1.1",
"3.8.1",
"3.8.0",
"3.7.5",
"3.7.4",
"3.7.3",
"3.6.6",
"3.7.4-rc.1",
"3.5.7.1",
"3.7.2.1",
"3.7.2",
"3.7.1",
"3.7.0.2",
"3.7.0.1",
"3.7.0",
"3.6.5",
"3.6.4",
"3.6.3.1",
"3.6.3",
"3.6.2",
"3.6.2-rc.3",
"3.6.2-rc.2",
"3.6.2-rc.1",
"3.6.1.1",
"3.6.0",
"3.5.7",
"3.5.6",
"3.5.5",
"3.5.4",
"3.5.3.1",
"3.5.3",
"3.5.2",
"3.5.1",
"3.5.1-rc.1",
"3.5.0",
"3.5.0-rc.7",
"3.5.0-rc.6",
"3.5.0-rc.5",
"3.5.0-rc.4",
"3.5.0-rc.3",
"3.5.0-rc.2",
"3.5.0-rc.1",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.6",
"3.3.5",
"3.3.4",
"3.3.3",
"3.3.2",
"3.3.1",
"3.3.0",
"3.2.5",
"3.2.5-rc.2",
"3.2.5-rc.1",
"3.2.3-rc.1",
"3.2.2",
"3.2.1",
"3.2.1-rc.1",
"3.2.0",
"3.2.0-rc.4",
"3.2.0-rc.3",
"3.2.0-rc.2",
"3.2.0-rc.1",
"3.1.4",
"3.1.4-rc.1",
"3.1.3",
"3.1.3-rc.1",
"3.1.2",
"3.1.2-rc.1",
"3.1.1",
"3.1.0",
"3.1.0-rc.1",
"3.0.3",
"3.0.3-rc.3",
"3.0.3-rc.2",
"3.0.3-rc.1",
"3.0.2",
"3.0.2-rc.1",
"3.0.1",
"3.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42069.json"
}
}
],
"modified": "2026-10-28T02:30:48.738688972Z",
"provider": "osv",
"references": [
"https://github.com/getkirby/kirby/releases/tag/4.9.0",
"https://github.com/getkirby/kirby/releases/tag/5.4.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42069.json",
"https://github.com/getkirby/kirby/security/advisories/GHSA-2h7v-4372-f6x2",
"https://nvd.nist.gov/vuln/detail/CVE-2026-42069"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42069.json"
}
},
"related_cves": [
{
"value": "CVE-2026-42069",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 517142,
"published_at": "2026-05-09T03:35:02.266+00:00"
}