Kirby content management system lacks authorization checks for creating, replacing, or deleting user avatars. As a result, any authenticated user may alter another user's avatar without permission, enabling impersonation or defacement of user profiles. This flaw does not grant additional privileges or full access, but it can erode trust and hinder user identification.

Versions of Kirby prior to 4.9.0 and 5.4.0 are affected. The vulnerability applies to the open-source Kirby CMS published under the getkirby:kirby vendor/product name.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the flaw is not listed in CISA KEV. The likely attack path involves a normal authenticated user interacting with the avatar management endpoints, with no special network or privilege prerequisites inferred from the description.