Medium
Kirby: System API endpoint leaks license data and installed version to authenticated users
Type: advisorySources: OSV
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-42051
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 01:49 UTC · Revision 1
Source evidence
Kirby: System API endpoint leaks license data and installed version to authenticated users
core-osv · Original sourcePublished 9 May 2026, 03:37 UTC
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.
osv:CVE-2026-42051
Complete source record
{
"id": "75b230c0572b374fb778c081527f2ec330512d037e5366d0c5e0daf9c6eead9c",
"url": "https://osv.dev/vulnerability/CVE-2026-42051",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Kirby: System API endpoint leaks license data and installed version to authenticated users",
"summary": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.",
"evidence": "osv:CVE-2026-42051",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-42051",
"aliases": [
"CVE-2026-42051",
"GHSA-x68m-c7jf-2572"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/getkirby/kirby",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d952dfc0a890979c863ec5fa11660e37400f0f4c"
},
{
"introduced": "2ff182ba39ddea19fa1615bd3733f734b5e53842"
},
{
"fixed": "80061614af90387da8b8ff9d92b390050a5f958f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.9.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.4.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "d952dfc0a890979c863ec5fa11660e37400f0f4c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "4.9.0"
},
{
"range": [
{
"fixed": "80061614af90387da8b8ff9d92b390050a5f958f"
}
],
"source": "REFERENCES_TAG",
"original_tag": "5.4.0"
}
]
}
}
],
"versions": [
"4.8.0",
"5.3.3",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.3",
"5.2.2",
"5.2.1",
"5.2.0",
"5.1.4",
"5.1.3",
"5.1.2",
"5.1.1",
"5.1.0",
"5.0.4",
"5.0.3",
"5.0.2",
"5.0.1",
"5.0.0",
"4.7.2",
"4.7.1",
"4.7.0",
"4.6.1",
"4.6.0",
"4.5.0",
"4.4.1",
"4.4.0",
"4.3.1",
"4.3.0",
"4.2.0",
"4.1.2",
"4.1.1",
"4.1.0",
"3.9.8",
"4.0.3",
"4.0.2",
"4.0.1",
"4.0.0",
"3.9.7",
"3.9.6.1",
"3.9.6",
"3.8.4",
"3.9.6-rc.1",
"3.9.5",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.9.0",
"3.8.3",
"3.8.2",
"3.8.1.1",
"3.8.1",
"3.8.0",
"3.7.5",
"3.7.4",
"3.7.3",
"3.6.6",
"3.7.4-rc.1",
"3.5.7.1",
"3.7.2.1",
"3.7.2",
"3.7.1",
"3.7.0.2",
"3.7.0.1",
"3.7.0",
"3.6.5",
"3.6.4",
"3.6.3.1",
"3.6.3",
"3.6.2",
"3.6.2-rc.3",
"3.6.2-rc.2",
"3.6.2-rc.1",
"3.6.1.1",
"3.6.0",
"3.5.7",
"3.5.6",
"3.5.5",
"3.5.4",
"3.5.3.1",
"3.5.3",
"3.5.2",
"3.5.1",
"3.5.1-rc.1",
"3.5.0",
"3.5.0-rc.7",
"3.5.0-rc.6",
"3.5.0-rc.5",
"3.5.0-rc.4",
"3.5.0-rc.3",
"3.5.0-rc.2",
"3.5.0-rc.1",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.6",
"3.3.5",
"3.3.4",
"3.3.3",
"3.3.2",
"3.3.1",
"3.3.0",
"3.2.5",
"3.2.5-rc.2",
"3.2.5-rc.1",
"3.2.3-rc.1",
"3.2.2",
"3.2.1",
"3.2.1-rc.1",
"3.2.0",
"3.2.0-rc.4",
"3.2.0-rc.3",
"3.2.0-rc.2",
"3.2.0-rc.1",
"3.1.4",
"3.1.4-rc.1",
"3.1.3",
"3.1.3-rc.1",
"3.1.2",
"3.1.2-rc.1",
"3.1.1",
"3.1.0",
"3.1.0-rc.1",
"3.0.3",
"3.0.3-rc.3",
"3.0.3-rc.2",
"3.0.3-rc.1",
"3.0.2",
"3.0.2-rc.1",
"3.0.1",
"3.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42051.json"
}
}
],
"modified": "2026-10-28T02:30:48.686448199Z",
"provider": "osv",
"references": [
"https://github.com/getkirby/kirby/releases/tag/4.9.0",
"https://github.com/getkirby/kirby/releases/tag/5.4.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42051.json",
"https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572",
"https://nvd.nist.gov/vuln/detail/CVE-2026-42051"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42051.json"
}
},
"related_cves": [
{
"value": "CVE-2026-42051",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 517110,
"published_at": "2026-05-09T03:37:42.707+00:00"
}