CVE-2026-44176: Kirby CMS missing authorization in page draft rendering

CVE-2026-44176 · Severity: medium · CVSS 4 · Published 2026-07-16

Kirby, a content management system, contains a flaw where page drafts can be viewed by users who should not have access to them. If an authenticated user knows the specific web address of a draft, they can view its content even if their account permissions are set to restrict such access. This could lead to the premature disclosure of sensitive information, such as unreleased products or private blog posts.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-44176 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44176 being exploited in the wild.
How severe is CVE-2026-44176?
Medium severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Kirby < 4.9.1, >= 5.0.0, < 5.4.1, <= 4.9.0, >= 5.0.0, <= 5.4.0; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.1.
Is there a fix for CVE-2026-44176?
Yes. getkirby/cms (Packagist): upgrade to 4.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44176 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44176?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.1 or later
    composer require getkirby/cms:^4.9.1

Technical details

A missing authorization vulnerability exists in Kirby's path resolver for the main CMS router. While the resolver correctly identifies whether a request for a page draft is authenticated or contains a preview token, it fails to verify the specific 'pages.access' permission for the authenticated user. Consequently, any valid authenticated user can render and view a page draft if they possess the full path, regardless of the role-based access control (RBAC) settings defined in user or model blueprints. This issue is limited to read access; write actions are unaffected. The vulnerability is resolved in versions 4.9.1 and 5.4.1 by adding a check to verify user accessibility before rendering draft templates.

Affected products

  • Kirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1

Identifiers

  • CVE-2026-44176
  • GHSA-2xw4-v2wx-hqq9

Timeline

  • 2026-05-19: patched: Versions 4.9.1 and 5.4.1 released
  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-07-16: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.