# CVE-2026-49274: Kirby CMS missing authorization in PagePicker component

Source: https://junglewise.ai/threats/cve-2026-49274-kirby-cms-missing-authorization-in-pagepicker-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-49274 · Severity: medium · CVSS 4 · Published 2026-07-09

Kirby, an open-source content management system, contains a security flaw in its page selection tool. Authenticated users with restricted permissions could bypass access controls to verify if specific pages exist and view their titles, even if they were not authorized to see them. This could lead to the exposure of sensitive internal page structures or project names. The issue has been resolved in the latest software updates.

Technologies: [Kirby](https://junglewise.ai/threats/technologies/kirby), [getkirby/cms (Packagist)](https://junglewise.ai/threats/technologies/getkirby-cms). Vendors: [Kirby](https://junglewise.ai/threats/vendors/kirby), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-49274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49274 being exploited in the wild.

**How severe is CVE-2026-49274?** Medium severity, with a CVSS score of 4, published 9 July 2026.

**Which products and versions are affected?** Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.

**Is there a fix for CVE-2026-49274?** Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49274 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-49274?** Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getkirby/cms (Packagist): upgrade to 4.9.4 or later

  ```sh
  composer require getkirby/cms:^4.9.4
  ```


## Technical details

A missing authorization vulnerability (CWE-862) exists in Kirby's PagePicker component. When a user role has the 'pages.access' permission disabled, the backend fails to properly validate the accessibility of a parent page or site provided to the page picker. An authenticated attacker can exploit this by sending crafted requests to the page picker backend with an inaccessible parent ID. This allows the attacker to confirm the existence of arbitrary pages and retrieve their 'title' field values. The vulnerability is fixed in versions 4.9.4 and 5.4.4 by adding checks to ensure the requested parent is listable and accessible to the user.

## Affected products

- getkirby Kirby < 4.9.4, >= 5.0.0, < 5.4.4

## Identifiers

- CVE-2026-49274
- GHSA-23q2-54qv-rq5x

## Timeline

- 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
- 2026-07-09: disclosed: CVE-2026-49274 published

## References

- [https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55](https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55)
- [https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c](https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c)
- [https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f](https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f)
- [https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1](https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1)
- [https://github.com/getkirby/kirby/releases/tag/4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4)
- [https://github.com/getkirby/kirby/releases/tag/5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4)
- [https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x](https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x)

## Related threats

- [Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes)
- [Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory)
- [Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads)
- [Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages)
- [Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags)