Executive brief
Kirby, an open-source content management system, contains a security flaw in its page selection tool. Authenticated users with restricted permissions could bypass access controls to verify if specific pages exist and view their titles, even if they were not authorized to see them. This could lead to the exposure of sensitive internal page structures or project names. The issue has been resolved in the latest software updates.
Technical details
A missing authorization vulnerability (CWE-862) exists in Kirby's PagePicker component. When a user role has the 'pages.access' permission disabled, the backend fails to properly validate the accessibility of a parent page or site provided to the page picker. An authenticated attacker can exploit this by sending crafted requests to the page picker backend with an inaccessible parent ID. This allows the attacker to confirm the existence of arbitrary pages and retrieve their 'title' field values. The vulnerability is fixed in versions 4.9.4 and 5.4.4 by adding checks to ensure the requested parent is listable and accessible to the user.
Affected products
- getkirby Kirby < 4.9.4, >= 5.0.0, < 5.4.4
Timeline
- 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
- 2026-07-09: disclosed: CVE-2026-49274 published
References
- https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55
- https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c
- https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f
- https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1
- https://github.com/getkirby/kirby/releases/tag/4.9.4
- https://github.com/getkirby/kirby/releases/tag/5.4.4
- https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x