CVE-2026-54005

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4

Description Missing authorization in the content management system allows authenticated users to retrieve information for arbitrary published pages. By knowing or guessing page IDs or UUIDs, an attacker can access full content and metadata through the /api/site/find endpoint, even if the user role has the pages.access permission disabled. This issue can lead to the disclosure of sensitive information and confirmation of the existence of specific pages. This flaw does not allow write access or access to draft pages.

Recommendations Update Kirby to version 4.9.4 or later. Update Kirby to version 5.4.4 or later.