CVE-2026-42174: 
PHP vulnerability analysis and mitigation

CVE-2026-42174 is a missing authorization vulnerability in Kirby CMS (getkirby/cms) that allows authenticated users to create, replace, or delete user avatars without the required user.update or users.update permissions. It affects all Kirby versions up to and including 4.8.0, and versions 5.0.0 through 5.3.3. The vulnerability was published by maintainer bastianallgeier on April 23, 2026, and disclosed to the GitHub Advisory Database on May 4, 2026. It carries a CVSS v4 base score of 5.3 (Medium) and a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Kirby Advisory).

The root cause is CWE-862 (Missing Authorization): Kirby's avatar management logic only checked files.create and files.delete permissions when a user avatar was created, replaced, or deleted, but did not enforce the higher-level user.update or users.update permissions that govern changes to user profile data. Because user avatars are an integral part of the user profile, this omission created a permission bypass — a user with only file-level permissions could manipulate avatars of any user, including those of higher-privileged roles. The attack is conducted over the network, requires low privileges (an authenticated CMS account), and no user interaction (GitHub Advisory, Kirby Advisory).

Successful exploitation allows an authenticated attacker to upload, replace, or delete user avatars for any account on the Kirby CMS instance, bypassing the site's intended role-based access controls. The integrity impact is limited to avatar files — there is no confidentiality breach or availability impact, and no evidence of lateral movement potential beyond the avatar manipulation itself. Sites where all users are already permitted to manage avatars are not affected; only those with role-based restrictions on user.update/users.update are at risk (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.009% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated session, limiting the attack surface to users who already have CMS access (GitHub Advisory).

1. Authenticate: Log in to the Kirby CMS Panel with any account that has files.create, files.replace, or files.delete permissions but lacks user.update or users.update permissions.
2. Identify target user: Navigate to or enumerate user accounts accessible via the Panel or REST API to identify a target user whose avatar you wish to manipulate.
3. Send avatar API request: Issue a direct API request (e.g., POST /api/users/{userId}/avatar) to upload or replace the target user's avatar, or a DELETE /api/users/{userId}/avatar request to remove it, bypassing the missing user.update permission check.
4. Confirm bypass: Verify that the avatar was created, replaced, or deleted despite the role's user.update/users.update permission being disabled, confirming the authorization control was not enforced (Kirby Advisory).

• Logs: Kirby Panel or web server access logs showing POST or DELETE requests to /api/users/{userId}/avatar from accounts whose role should not have user.update permissions.
• File System: Unexpected changes to avatar files in the content/users/{userId}/ directory, including new, replaced, or missing avatar image files, at times inconsistent with normal user activity.
• Application Logs: Kirby debug or error logs showing avatar-related operations (create, replace, delete) performed by low-privileged user accounts (Kirby Advisory).

The vulnerability has been patched in Kirby 4.9.0 (a security backport for the Kirby 4.x branch) and Kirby 5.4.0. The fix adds user.update/users.update permission checks to all avatar create, replace, and delete operations, in addition to the existing file-level permission checks. No configuration-based workaround is available; upgrading to a patched version is the only remediation. Kirby 5 users are encouraged to upgrade to 5.4.0 or later; Kirby 4 users unable to migrate to Kirby 5 should upgrade to 4.9.0 (Kirby 4.9.0 Release, Kirby 5.4.0 Release).