Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-42051

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.

VectorNETWORK

PublishedMay 09, 2026, 04:16

Published Bysecurity-advisories@github.com

Base Score

Score4.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

getkirby/cms(Packagist)04.9.0N/A

getkirby/cms(Packagist)5.0.05.4.0N/A

References

https://github.com/getkirby/kirby/releases/tag/4.9.0
https://github.com/getkirby/kirby/releases/tag/5.4.0
https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572

Weakness Type

CWE-862

CVSS Metrics

Base Score

5.3

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Base SeverityMedium

Version

4.0

Attack Vector (AV)

NETWORK