PT-2026-43451 · Packagist+2 · Getkirby/Cms+1
CVE-2026-44176
·
Published
2026-05-26
·
Updated
2026-07-17
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Kirby versions prior to 4.9.1
Kirby versions prior to 5.4.1
Description
An authorization issue exists in the path resolver for the main CMS router. When a request is made for a page draft, the resolver verifies if the request contains a valid preview token or is authenticated by a valid user. However, the system fails to check the
pages.access permission during page draft rendering. This allows any authenticated user to access and render the frontend page of a draft if they know the full path, regardless of whether their user role has the required permissions defined in the user blueprints (site/blueprints/users/...) or model blueprints (site/blueprints/pages/...). This could result in the disclosure of sensitive information before its official release.Recommendations
Update Kirby to version 4.9.1 or later.
Update Kirby to version 5.4.1 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Getkirby/Cms
Kirby