CVE-2026-44176

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.1 Kirby versions prior to 5.4.1

Description An authorization issue exists in the path resolver for the main CMS router. When a request is made for a page draft, the resolver verifies if the request contains a valid preview token or is authenticated by a valid user. However, the system fails to check the pages.access permission during page draft rendering. This allows any authenticated user to access and render the frontend page of a draft if they know the full path, regardless of whether their user role has the required permissions defined in the user blueprints (site/blueprints/users/...) or model blueprints (site/blueprints/pages/...). This could result in the disclosure of sensitive information before its official release.

Recommendations Update Kirby to version 4.9.1 or later. Update Kirby to version 5.4.1 or later.