CVE-2026-42174 — getkirby/cms
CVE-2026-42174 is a CWE-862 vulnerability in getkirby/cms. A fix is available for getkirby/cms — see the affected versions and patch details below.
Kirby: User avatar creation, replacement and deletion are not gated by user update permissions
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42174.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Real-World Exposure
getkirby/cms🐘getkirby/cmsReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
TL;DR
This vulnerability affects all Kirby sites where users of a particular role have no permission to update user information (user.update or users.update permission is disabled). This can be due to configuration in the blueprint(s) of the acting users, via options in the blueprint(s) of the target users or via a combination of both settings.
Kirby sites are not affected if they intend all users of the site to be able to upload, replace or delete user avatars. The vulnerability can only be exploited by authenticated users.
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Impact
Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model using the options feature (for user models again in the user blueprints). The permissions and options together control the authorization of user actions.
Kirby provides the user.update and users.update permissions (among others) that control the authorization to update user information for the user's own data or the data of other users respectively. User files are separately gated by the files.create, files.replace and files.delete permissions (among others).
In affected releases, Kirby only checked the files.create and files.delete permissions during changes to user avatars. Even though avatars are an integral part of the user profile, they were not covered by the user.update and users.update permissions. This allowed users with just file permissions to create, replace or delete user avatars.
Patches
The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have added additional permission checks for user.update/users.update when a user avatar is created, replaced or deleted. These permission checks apply in addition to the file permission checks (files.create, files.replace and files.delete). When a user avatar is replaced with a file of the same type, Kirby now consistently checks the files.replace permission instead of a combination of files.create and files.delete.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | getkirby/cms | all versions | 4.9.0composer require getkirby/cms:^4.9.0 |
| 🐘Packagist | getkirby/cms | ≥ 5.0.0&&< 5.4.0 | 5.4.0composer require getkirby/cms:^5.4.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getkirby/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update getkirby/cms to 4.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-42174 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-42174 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-42174. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-42174 in your dependencies?
O3 Security finds CVE-2026-42174 across Packagist dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.