Junglewise Threat Intelligence

CVE-2026-54005: Kirby CMS missing authorization in site/find API route

CVE-2026-54005 · Severity: high · CVSS 7.1 · Published 2026-07-09

Technologies: Kirby CMS, Kirby. Vendors: Kirby.

Executive brief

Kirby is an open-source content management system used to build and manage websites. A security flaw allowed logged-in users to bypass access restrictions and view the full content and metadata of pages they were not supposed to see. This could lead to the exposure of sensitive internal information or private website content if an attacker knows or guesses the specific page identifiers.

Technical details

A missing authorization check (CWE-862) exists in the '/api/site/find' REST API route of Kirby CMS. While the system allows administrators to disable the 'pages.access' permission for specific user roles, the affected API endpoint failed to verify this permission when processing requests. An authenticated attacker with low privileges can exploit this by sending a POST request to the endpoint with known or guessed page IDs or UUIDs. Successful exploitation allows the retrieval of full page content and metadata for any published page, regardless of configured access restrictions. The vulnerability is fixed in versions 4.9.4 and 5.4.4 by ensuring the route filters results based on the user's access rights.

Affected products

  • Kirby Kirby CMS < 4.9.4, >= 5.0.0, < 5.4.4

Timeline

  • 2026-06-17: advisory: Vendor security advisory published via GitHub and release notes
  • 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
  • 2026-07-09: disclosed: CVE-2026-54005 published to NVD

References

Related threats