CVE-2026-54005

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published...

CVE-2026-54005: Missing Authorization

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the /api/site/find route. An attacker can access sensitive page information, including full content and metadata, by sending requests with known or guessed page IDs or UUIDs as an authenticated user. This is on...