7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42137

CVE-2026-42137: Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42137

CVE-2026-42137:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
getkirby/cms	composer	<= 4.8.0	4.9.0
getkirby/cms	composer	>= 5.0.0, <= 5.3.3	5.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

This vulnerability in Kirby CMS stems from inconsistent and incorrect authorization checks within the Panel and REST API, allowing authenticated users to access information they are not supposed to see. The core of the issue lies in the failure to consistently use the isListable() permission check, which is intended to control whether pages, files, and other models appear in lists.

The analysis of the security patches reveals several key areas where these checks were missing or improperly implemented:

REST API Model Resolvers: The API did not filter collections of related models (like children, drafts, files, parents, siblings) based on the isListable permission. For example, when requesting a Site object, the API would return all associated children, drafts, and files, even if the user's role was configured to restrict access to some of them. This was fixed by adding .filter('isListable', true) to the respective API model resolvers.
Incorrect Permission Flags: In some parts of the API, the check was performed against isAccessible() instead of isListable(). The access permission is a stricter check that also controls direct access, while list is specifically for visibility in collections. This incorrect usage meant that items would appear in lists when they should have been hidden. The patch corrected this by replacing isAccessible checks with isListable.
Panel UI Components: The Panel, Kirby's admin interface, also suffered from similar issues. For instance, images for pages, sites, or users were displayed in lists even if the underlying file was not listable. Similarly, navigation links to the previous/next file in the file view did not respect listability permissions. The patches introduced the isListable() check in the relevant Panel components to ensure that only authorized content is displayed.
Direct Model Access: In some cases, direct access to models like the main Site object was not properly gated by permissions, allowing users to retrieve information about models they should not have access to. This was addressed by enforcing permission checks in the functions that retrieve these models.

By systematically adding and correcting these permission checks across the API and Panel, the patches ensure that the pages.list and files.list permissions are consistently enforced, preventing unauthorized information disclosure.

Vulnerable functions

Kirby\Cms\Api::files

src/Cms/Api.php

The `files` method in the `Api` class was using `isAccessible` instead of `isListable` to filter files. This is an incorrect permission check that could lead to information disclosure, as `isListable` is the correct permission for filtering lists.

Kirby\Cms\Api::pages

src/Cms/Api.php

The `pages` method in the `Api` class was using `isAccessible` instead of `isListable` to filter pages. This is an incorrect permission check that could lead to information disclosure, as `isListable` is the correct permission for filtering lists.

Kirby\Panel\Model::imageSource

src/Panel/Model.php

The `imageSource` method did not check if a `CmsFile` was listable before returning it. This could lead to the display of images in the Panel that the user is not supposed to see.

Kirby\Panel\File::prevNext

src/Panel/File.php

The `prevNext` method did not filter sibling files by `isListable` when generating links for previous and next files in the Panel. This allowed users to navigate to files they should not have access to.

Anonymous function for 'children', 'drafts', 'files' in config/api/models/Site.php

config/api/models/Site.php

The API resolvers for `children`, `drafts`, and `files` on the `Site` model did not filter the results based on the `isListable` permission. This allowed authenticated users to see all children, drafts, and files via the API, regardless of their permissions.

Anonymous function for 'next', 'prev', 'parent', 'parents', 'nextWithTemplate', 'prevWithTemplate' in config/api/models/File.php

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.