CVE-2026-49274: Kirby CMS missing authorization in PagePicker component

CVE-2026-49274 · Severity: medium · CVSS 4 · Published 2026-07-09

Kirby, an open-source content management system, contains a security flaw in its page selection tool. Authenticated users with restricted permissions could bypass access controls to verify if specific pages exist and view their titles, even if they were not authorized to see them. This could lead to the exposure of sensitive internal page structures or project names. The issue has been resolved in the latest software updates.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-49274 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49274 being exploited in the wild.
How severe is CVE-2026-49274?
Medium severity, with a CVSS score of 4, published 9 July 2026.
Which products and versions are affected?
Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.
Is there a fix for CVE-2026-49274?
Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49274 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-49274?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.4 or later
    composer require getkirby/cms:^4.9.4

Technical details

A missing authorization vulnerability (CWE-862) exists in Kirby's PagePicker component. When a user role has the 'pages.access' permission disabled, the backend fails to properly validate the accessibility of a parent page or site provided to the page picker. An authenticated attacker can exploit this by sending crafted requests to the page picker backend with an inaccessible parent ID. This allows the attacker to confirm the existence of arbitrary pages and retrieve their 'title' field values. The vulnerability is fixed in versions 4.9.4 and 5.4.4 by adding checks to ensure the requested parent is listable and accessible to the user.

Affected products

  • getkirby Kirby < 4.9.4, >= 5.0.0, < 5.4.4

Identifiers

  • CVE-2026-49274
  • GHSA-23q2-54qv-rq5x

Timeline

  • 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
  • 2026-07-09: disclosed: CVE-2026-49274 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.