EUVD-2026-42670
GHSA-r3w8-2c5r-h9j9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network REST route reachable by any authenticated low-privilege user (PR:L), no interaction; pure information disclosure of restricted page content, so C:H and I:N/A:N.
Primary rating from Vendor (https://github.com/getkirby/kirby).
CVSS VectorVendor: https://github.com/getkirby/kirby
Lifecycle Timeline
6DescriptionCVE.org
TL;DR
This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings.
It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the /api/site/find route without being authorized to access the respective pages.
This vulnerability is of high severity for affected sites.
Your Kirby sites are *not* affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are *not* affected by this vulnerability.
----
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Affected components
The /api/site/find route allows callers to request model data for a collection of user-selected pages. This model data includes structural metadata about the page itself and its children, siblings, and files and can also be extended via a query parameter to return full page content and additional metadata. The pages to return can be queried by a list of page IDs and/or UUIDs. Draft pages are excluded from this route as it only supports querying published pages.
Impact
In affected releases, Kirby did not check whether the queried pages were accessible to the currently authenticated user.
This can lead to disclosure of sensitive information contained in inaccessible pages, including the confirmation of the existence of individual pages as well as disclosure of sensitive content fields stored in the pages. Linked children, siblings, or files were *not* affected by this vulnerability as they were already properly filtered by the appropriate pages.list and files.list permissions.
Because the /api/site/find route is read-only, the vulnerability does *not* allow malicious write access.
Patches
The problem has been patched in Kirby 4.9.4 and Kirby 5.4.4. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we added a filter ensuring that the /api/site/find route only returns pages that are accessible to the current user.
Credits
Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.
AnalysisAI
Missing authorization in Kirby CMS lets authenticated users read the full content and metadata of pages they are not permitted to access via the /api/site/find REST route. It affects sites where a user role has the pages.access permission disabled (through user blueprints, model blueprint options, or a combination), on Kirby <= 4.9.3 and 5.0.0-alpha.1 through 5.4.3. No public exploit identified at time of analysis; the flaw is read-only and cannot be used for write access, and the CVSS 4.0 vector rates confidentiality impact High (score 7.1).
Technical ContextAI
Kirby is a flat-file, blueprint-driven PHP CMS (distributed as the Composer package getkirby/cms) whose Panel and REST API expose model data over routes such as /api/site/find. That route returns model data for a caller-supplied list of published pages selected by ID or UUID, and a query parameter can expand the response to include full page content and additional metadata. The root cause is CWE-862 (Missing Authorization): the route resolved and returned page models without evaluating the per-user pages.access permission that governs whether a role may access a given page. Notably, linked children, siblings, and files were still correctly filtered by the pages.list and files.list permissions, so the gap was specific to the top-level access check on the directly requested pages.
RemediationAI
Upgrade to a fixed release: Vendor-released patch: Kirby 4.9.4 (https://github.com/getkirby/kirby/releases/tag/4.9.4) for the 4.x branch or Kirby 5.4.4 (https://github.com/getkirby/kirby/releases/tag/5.4.4) for the 5.x branch, or any later version; the vendor recommends upgrading to Kirby 5 where possible and treats 4.9.4 as a backport alternative. The fix adds a filter so /api/site/find only returns pages accessible to the current user (commits a16dbd4329293c2c4b9a375d2badcb27c6337004 and b22d0b64b6478ce6871dc7ec3368d7afaf078688). If immediate patching is not possible, do not rely on pages.access as a confidentiality boundary: either grant affected roles full page access to remove the mismatch the bug exploits (accepting broader visibility for those users), or restrict Panel/API accounts to fully trusted users and audit which roles have pages.access disabled while sensitive content is present. Restricting the Panel/API surface to trusted networks reduces external exposure but does not stop an authenticated insider.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today