CVE-2026-49274CWE-862

Kirby: `pages.access` permission is not checked in the pages picker for parent pages

Medium · published July 9, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00484 · 40.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-09T18:38Z
EPSS history
Timeline
  • 09 JUL 18:38Z
    Kirby: `pages.access` permission is not checked in the pages picker for parent pages
    cvelistv5