CVE-2026-54005: Kirby CMS missing authorization in site/find API route

CVE-2026-54005 · Severity: high · CVSS 4 · Published 2026-07-09

Kirby is an open-source content management system used to build and manage websites. A security flaw allowed logged-in users to bypass access restrictions and view the full content and metadata of pages they were not supposed to see. This could lead to the exposure of sensitive internal information or private website content if an attacker knows or guesses the specific page identifiers.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-54005 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54005 being exploited in the wild.
How severe is CVE-2026-54005?
High severity, with a CVSS score of 4, published 9 July 2026.
Which products and versions are affected?
Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.
Is there a fix for CVE-2026-54005?
Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54005 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54005?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.4 or later
    composer require getkirby/cms:^4.9.4

Technical details

A missing authorization check (CWE-862) exists in the '/api/site/find' REST API route of Kirby CMS. While the system allows administrators to disable the 'pages.access' permission for specific user roles, the affected API endpoint failed to verify this permission when processing requests. An authenticated attacker with low privileges can exploit this by sending a POST request to the endpoint with known or guessed page IDs or UUIDs. Successful exploitation allows the retrieval of full page content and metadata for any published page, regardless of configured access restrictions. The vulnerability is fixed in versions 4.9.4 and 5.4.4 by ensuring the route filters results based on the user's access rights.

Affected products

  • Kirby Kirby CMS < 4.9.4, >= 5.0.0, < 5.4.4

Identifiers

  • CVE-2026-54005
  • GHSA-r3w8-2c5r-h9j9

Timeline

  • 2026-06-17: advisory: Vendor security advisory published via GitHub and release notes
  • 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
  • 2026-07-09: disclosed: CVE-2026-54005 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.