CVE-2026-44176

Kirby CMS vulnerability CVE-2026-44176 affects pre-4.9.1 and pre-5.4.1 releases where the path resolver could render page drafts without enforcing pages.access, potentially exposing sensitive draft content to authenticated users who know the full draft path. Root cause: page draft rendering bypas...

GHSA-2XW4-V2WX-HQQ9 Kirby CMS's `pages.access` permission is not checked during rendering of page drafts

TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages pages.access permission is disabled. This can be due to configuration in the user blueprints, via options in the model blueprints or via a combination of both settings. Kirby sites...