CVE-2026-54005

creationtimestamp| type| source ---|---|--- 2026-07-09 20:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqai4jjnxs24...

CVE-2026-54005 Kirby: `pages.access` permission is not checked in the `site/find` REST API route

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published...