CVE-2026-45334: Kirby CMS information disclosure in content-locking feature

CVE-2026-45334 · Severity: medium · CVSS 4 · Published 2026-07-16

Kirby CMS, a popular content management system, contained a flaw where low-privileged users could see the email addresses and internal IDs of other users, including administrators. This occurred through the 'content-locking' feature, which normally shows who is currently editing a page to prevent conflicting changes. An attacker could use this information to identify administrative accounts for targeted phishing or credential-stuffing attacks.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-45334 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45334 being exploited in the wild.
How severe is CVE-2026-45334?
Medium severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Kirby < 4.9.1, >= 5.0.0, < 5.4.1, <= 4.9.0, >= 5.0.0, <= 5.4.0; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.1.
Is there a fix for CVE-2026-45334?
Yes. getkirby/cms (Packagist): upgrade to 4.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45334 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45334?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.1 or later
    composer require getkirby/cms:^4.9.1

Technical details

A missing authorization vulnerability (CWE-862) exists in Kirby's Panel content-locking mechanism. The system records which user has a model open for editing and includes that user's email address and internal identifier in Panel view payloads and error responses. While this is intended to coordinate editing, the application failed to verify if the requesting user had 'users.access' or 'users.list' permissions. Consequently, an authenticated user with restricted permissions could enumerate the details of any user currently editing content, including high-privilege administrators. This issue is resolved in versions 4.9.1 and 5.4.1 by filtering lock information based on the requester's permissions.

Affected products

  • getkirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1

Identifiers

  • CVE-2026-45334
  • GHSA-39vq-49qm-r2mc

Timeline

  • 2026-05-19: patched: Fixes released in versions 4.9.1 and 5.4.1
  • 2026-05-19: advisory: GitHub Security Advisory GHSA-39vq-49qm-r2mc published
  • 2026-07-16: disclosed: CVE-2026-45334 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.