# CVE-2026-45334: Kirby CMS information disclosure in content-locking feature

Source: https://junglewise.ai/threats/cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-45334 · Severity: medium · CVSS 4 · Published 2026-07-16

Kirby CMS, a popular content management system, contained a flaw where low-privileged users could see the email addresses and internal IDs of other users, including administrators. This occurred through the 'content-locking' feature, which normally shows who is currently editing a page to prevent conflicting changes. An attacker could use this information to identify administrative accounts for targeted phishing or credential-stuffing attacks.

Technologies: [Kirby](https://junglewise.ai/threats/technologies/kirby), [getkirby/cms (Packagist)](https://junglewise.ai/threats/technologies/getkirby-cms). Vendors: [Kirby](https://junglewise.ai/threats/vendors/kirby), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-45334 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45334 being exploited in the wild.

**How severe is CVE-2026-45334?** Medium severity, with a CVSS score of 4, published 16 July 2026.

**Which products and versions are affected?** Kirby < 4.9.1, >= 5.0.0, < 5.4.1, <= 4.9.0, >= 5.0.0, <= 5.4.0; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.1.

**Is there a fix for CVE-2026-45334?** Yes. getkirby/cms (Packagist): upgrade to 4.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45334 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45334?** Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getkirby/cms (Packagist): upgrade to 4.9.1 or later

  ```sh
  composer require getkirby/cms:^4.9.1
  ```


## Technical details

A missing authorization vulnerability (CWE-862) exists in Kirby's Panel content-locking mechanism. The system records which user has a model open for editing and includes that user's email address and internal identifier in Panel view payloads and error responses. While this is intended to coordinate editing, the application failed to verify if the requesting user had 'users.access' or 'users.list' permissions. Consequently, an authenticated user with restricted permissions could enumerate the details of any user currently editing content, including high-privilege administrators. This issue is resolved in versions 4.9.1 and 5.4.1 by filtering lock information based on the requester's permissions.

## Affected products

- getkirby Kirby CMS < 4.9.1, >= 5.0.0, < 5.4.1

## Identifiers

- CVE-2026-45334
- GHSA-39vq-49qm-r2mc

## Timeline

- 2026-05-19: patched: Fixes released in versions 4.9.1 and 5.4.1
- 2026-05-19: advisory: GitHub Security Advisory GHSA-39vq-49qm-r2mc published
- 2026-07-16: disclosed: CVE-2026-45334 published to NVD

## References

- [https://github.com/getkirby/kirby/releases/tag/5.4.1](https://github.com/getkirby/kirby/releases/tag/5.4.1)
- [https://github.com/getkirby/kirby/security/advisories/GHSA-39vq-49qm-r2mc](https://github.com/getkirby/kirby/security/advisories/GHSA-39vq-49qm-r2mc)

## Related threats

- [Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes)
- [Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory)
- [Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads)
- [Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages)
- [Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags)