CVE-2026-54005
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Kirby CMS before versions 4.9.4 and 5.4.4, users with the pages.access permission disabled could retrieve full content and metadata of any published page via the /api/site/find endpoint by knowing page IDs or UUIDs. This vulnerability allowed unauthorized access to pages that should have been protected.
Risk Assessment
The organization is at risk of confidential data leakage, including full page content and metadata, to authenticated users without proper permissions. This could lead to access policy violations and exposure of sensitive information.
Recommendation
Immediately update Kirby to version 4.9.4 or 5.4.4, which contain the fix for this vulnerability. After updating, verify the access permission configuration for pages.
Other vulnerabilities in Kirby
See all- CVE-2026-54003Critical
A vulnerability in the Kirby content management system allows a remote attacker to bypass local IP checks and install the Panel and create the first admin account. The issue affects versions prior to 4.9.4 and 5.4.4 when the server runs behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP request headers.
- CVE-2026-69127Medium
A vulnerability in the Kirby content management system prior to version 4.9.5 and from 5.0.0 through 5.5.1 causes the REST API error handler to return unsanitized PHP error messages, exposing the full filesystem path of the Kirby installation to unauthenticated API users. This affects all sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2.
- CVE-2026-42137Medium
In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.
- CVE-2026-42069Medium
Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.
- CVE-2026-42051Medium
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.
- CVE-2018-14519Medium
In Kirby 2.5.12, a CSRF vulnerability was found in the delete page functionality. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
Original NVD description (English source)
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published pages through the /api/site/find route without authorization to access those pages. This issue is fixed in versions 4.9.4 and 5.4.4.