CVE-2026-42051: Getkirby/cms Kirby CMS's System API Endpoint Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x68m-c7jf-2572",
  "modified" : "2026-05-13T13:38:59Z",
  "published" : "2026-05-04T19:59:30Z",
  "aliases" : [ "CVE-2026-42051" ],
  "summary" : "Kirby CMS's system API endpoint leaks installed version and license data to authenticated users",
  "details" : "### TL;DR\n\nThis vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.\n\n----\n\n### Introduction\n\nMissing authorization allows authenticated users to perform actions they are not intended to have access to.\n\nThe effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.\n\n### Impact\n\nKirby's user permissions control which user role is allowed to perform specific actions in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). The permissions control the authorization of user actions (with handling of model-specific authorization omitted here for brevity).\n\nKirby provides the `access.system` permission (among others) that controls access to the system area of the Kirby Panel. This area contains internal system information like the installed Kirby, plugin and server versions, security state and Kirby license. If the `access.system` permission is disabled for a user role, users of that role should not be able to access this internal system information. However it is also possible to access some system information via the `/api/system` REST API endpoint. In affected releases, the response of this endpoint for authenticated users contained the installed Kirby version and the status, type and code of the installed Kirby license. These values are considered sensitive information and should be protected by the `access.system` permission.\n\nThe installed Kirby version and license data can be used by malicious actors during reconnaissance when planning a separate attack.\n\n### Patches\n\nThe problem has been patched in [Kirby 4.9.0](https://github.com/getkirby/kirby/releases/tag/4.9.0) and [Kirby 5.4.0](https://github.com/getkirby/kirby/releases/tag/5.4.0). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, we have protected the version and license properties of the `/api/system` endpoint with a check for the existing `access.system` permission. This ensures that the REST API only outputs information that should be accessible to the user via the Panel.\n\n### Credits\n\nKirby thanks @HuajiHD and @0x-bala for responsibly reporting the identified issue.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "getkirby/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.9.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.8.0"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "getkirby/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.4.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.3.3"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42051"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/getkirby/kirby"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getkirby/kirby/releases/tag/4.9.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getkirby/kirby/releases/tag/5.4.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-04T19:59:30Z",
    "nvd_published_at" : "2026-05-09T04:16:22Z"
  }
}