Executive brief
Kirby, a content management system, contains a flaw where page drafts can be viewed by users who should not have access to them. If an authenticated user knows the specific web address of a draft, they can view its content even if their account permissions are set to restrict such access. This could lead to the premature disclosure of sensitive information, such as unreleased products or private blog posts.
Technical details
A missing authorization vulnerability exists in Kirby's path resolver for the main CMS router. While the resolver correctly identifies whether a request for a page draft is authenticated or contains a preview token, it fails to verify the specific 'pages.access' permission for the authenticated user. Consequently, any valid authenticated user can render and view a page draft if they possess the full path, regardless of the role-based access control (RBAC) settings defined in user or model blueprints. This issue is limited to read access; write actions are unaffected. The vulnerability is resolved in versions 4.9.1 and 5.4.1 by adding a check to verify user accessibility before rendering draft templates.
Affected products
- Kirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1
Timeline
- 2026-05-19: patched: Versions 4.9.1 and 5.4.1 released
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD publication date