CVE-2026-49274

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4

Description Authenticated users can confirm the existence of arbitrary pages and retrieve their title field values. This occurs when sites use the pages field and user roles have the pages.access permission disabled. The issue stems from missing authorization in the backend logic of the page picker, which fails to validate if the user-provided parent page or site is accessible to the current user. This could lead to the disclosure of sensitive information.

Recommendations Update Kirby to version 4.9.4 or later. Update Kirby to version 5.4.4 or later.