CVE-2026-42137

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.

• CWE-862
• CWE-863

• https://github.com/getkirby/kirby/releases/tag/4.9.0Release Notes
• https://github.com/getkirby/kirby/releases/tag/5.4.0Release Notes
• https://github.com/getkirby/kirby/security/advisories/GHSA-85x2-r8xv-ww8cPatch, Vendor Advisory

Published

May 9, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42100Improper Handling of Syntactically Invalid Structure in Spar…7.5
• CVE-2026-4211A weakness has been identified in D-Link DNS-120, DNR-202L, …9.8
• CVE-2026-4212A security vulnerability has been detected in D-Link DNS-120…9.8
• CVE-2026-42127The public dashboard query endpoint does not limit request b…7.5
• CVE-2026-42129A user with Viewer permissions can use a path traversal in t…7.7
• CVE-2026-4213A vulnerability was detected in D-Link DNS-120, DNR-202L, DN…9.8
• CVE-2026-42138Dify is an open-source LLM app development platform. Prior t…6.1
• CVE-2026-4214A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L,…9.8
• CVE-2026-42140PlantUML Macro is a macro for rendering UML diagrams from si…4.4
• CVE-2026-42141Xibo is an open source digital signage platform with a web c…7.7
• CVE-2026-42142TypeBot is a chatbot builder tool. Prior to version 3.17.0, …7.1
• CVE-2026-42143Coolify is an open-source and self-hostable tool for managin…8.8