CVE-2026-42069

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.

• CWE-862

• https://github.com/getkirby/kirby/releases/tag/4.9.0Release Notes
• https://github.com/getkirby/kirby/releases/tag/5.4.0Release Notes
• https://github.com/getkirby/kirby/security/advisories/GHSA-2h7v-4372-f6x2Patch, Vendor Advisory

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42055NGINX Plus and NGINX Open Source have a vulnerability in the…9.2
• CVE-2026-42058An authenticated attacker's undisclosed requests to BIG-IP i…5.3
• CVE-2026-4206A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-3…9.8
• CVE-2026-42061Local privilege escalation due to excessive permissions assi…7.3
• CVE-2026-42062ELECOM wireless LAN access point devices contain an OS comma…9.8
• CVE-2026-42063A vulnerability exists in iControl SOAP where an authenticat…6.9
• CVE-2026-4207A vulnerability was determined in D-Link DNS-120, DNR-202L, …9.8
• CVE-2026-42070Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
• CVE-2026-42071Mantis Bug Tracker (MantisBT) is an open source issue tracke…7.2
• CVE-2026-42072Nornicdb is a distributed low-latency, Graph+Vector, Tempora…9.8
• CVE-2026-42073OpenClaude is an open-source coding-agent command line inter…6.5
• CVE-2026-42074OpenClaude is an open-source coding-agent command line inter…9.8