CVE-2026-42174: Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions

Kirby’s user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model using the options feature (for user models again in the user blueprints). The permissions and options together control the authorization of user actions.

Kirby provides the user.update and users.update permissions (among others) that control the authorization to update user information for the user’s own data or the data of other users respectively. User files are separately gated by the files.create, files.replace and files.delete permissions (among others).

In affected releases, Kirby only checked the files.create and files.delete permissions during changes to user avatars. Even though avatars are an integral part of the user profile, they were not covered by the user.update and users.update permissions. This allowed users with just file permissions to create, replace or delete user avatars.