Executive brief
Kirby CMS, a popular content management system, contained a flaw where low-privileged users could see the email addresses and internal IDs of other users, including administrators. This occurred through the 'content-locking' feature, which normally shows who is currently editing a page to prevent conflicting changes. An attacker could use this information to identify administrative accounts for targeted phishing or credential-stuffing attacks.
Technical details
A missing authorization vulnerability (CWE-862) exists in Kirby's Panel content-locking mechanism. The system records which user has a model open for editing and includes that user's email address and internal identifier in Panel view payloads and error responses. While this is intended to coordinate editing, the application failed to verify if the requesting user had 'users.access' or 'users.list' permissions. Consequently, an authenticated user with restricted permissions could enumerate the details of any user currently editing content, including high-privilege administrators. This issue is resolved in versions 4.9.1 and 5.4.1 by filtering lock information based on the requester's permissions.
Affected products
- getkirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1
Timeline
- 2026-05-19: patched: Fixes released in versions 4.9.1 and 5.4.1
- 2026-05-19: advisory: GitHub Security Advisory GHSA-39vq-49qm-r2mc published
- 2026-07-16: disclosed: CVE-2026-45334 published to NVD