Summary
Kirby: pages.access permission is not checked in the pages picker for parent pages
TL;DR
This vulnerability affects all Kirby sites that use the pages field and where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings.
It was possible to confirm the existence of arbitrary pages and to retrieve the value of the title field of the pages found.
The vulnerability can only be exploited by authenticated users. Write actions are not affected by this vulnerability.
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Affected components
Kirby's user permissions control which user role is allowed to perform specific actions on content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions.
Kirby provides the pages.access and pages.list permissions (among others). The list permission controls whether affected models appear in lists throughout the Panel and REST API. The access permission has the same effect but also disables direct access to the affected models.
This vulnerability affects the backend logic for the page picker that is used in the pages field to select pages. The picker is opened based on a user-provided parent page or the site model.
Impact
In affected releases, the backend logic did not validate that the user-provided parent page or site was accessible to the current user. This allowed authenticated attackers with knowledge of the full path to an existing page to confirm the existence of a particular page and to retrieve the value of the title field of that page. This could lead to the disclosure of sensitive information.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The problem has been patched in Kirby 4.9.4 and Kirby 5.4.4. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have added a check verifying that the requested parent page or site is accessible to the current user before returning the picker data.
Frequently Asked Questions
- What is CVE-2026-49274? CVE-2026-49274 is a medium-severity missing authorization vulnerability in getkirby/cms (composer), affecting versions <= 4.9.3. It is fixed in 4.9.4, 5.4.4. The application does not perform an authorization check before performing a sensitive operation.
- Which versions of getkirby/cms are affected by CVE-2026-49274? getkirby/cms (composer) versions <= 4.9.3 is affected.
- Is there a fix for CVE-2026-49274? Yes. CVE-2026-49274 is fixed in 4.9.4, 5.4.4. Upgrade to this version or later.
- Is CVE-2026-49274 exploitable, and should I be worried? Whether CVE-2026-49274 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-49274 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-49274?
- Upgrade
getkirby/cmsto 4.9.4 or later - Upgrade
getkirby/cmsto 5.4.4 or later
- Upgrade