Summary
Kirby: pages.access permission is not checked in the site/find REST API route
TL;DR
This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings.
It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the /api/site/find route without being authorized to access the respective pages.
This vulnerability is of high severity for affected sites.
Your Kirby sites are not affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are not affected by this vulnerability.
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Affected components
The /api/site/find route allows callers to request model data for a collection of user-selected pages. This model data includes structural metadata about the page itself and its children, siblings, and files and can also be extended via a query parameter to return full page content and additional metadata. The pages to return can be queried by a list of page IDs and/or UUIDs. Draft pages are excluded from this route as it only supports querying published pages.
Credits
Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.
Impact
In affected releases, Kirby did not check whether the queried pages were accessible to the currently authenticated user.
This can lead to disclosure of sensitive information contained in inaccessible pages, including the confirmation of the existence of individual pages as well as disclosure of sensitive content fields stored in the pages. Linked children, siblings, or files were not affected by this vulnerability as they were already properly filtered by the appropriate pages.list and files.list permissions.
Because the /api/site/find route is read-only, the vulnerability does not allow malicious write access.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The problem has been patched in Kirby 4.9.4 and Kirby 5.4.4. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we added a filter ensuring that the /api/site/find route only returns pages that are accessible to the current user.
Frequently Asked Questions
- What is CVE-2026-54005? CVE-2026-54005 is a high-severity missing authorization vulnerability in getkirby/cms (composer), affecting versions <= 4.9.3. It is fixed in 4.9.4, 5.4.4. The application does not perform an authorization check before performing a sensitive operation.
- Which versions of getkirby/cms are affected by CVE-2026-54005? getkirby/cms (composer) versions <= 4.9.3 is affected.
- Is there a fix for CVE-2026-54005? Yes. CVE-2026-54005 is fixed in 4.9.4, 5.4.4. Upgrade to this version or later.
- Is CVE-2026-54005 exploitable, and should I be worried? Whether CVE-2026-54005 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54005 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54005?
- Upgrade
getkirby/cmsto 4.9.4 or later - Upgrade
getkirby/cmsto 5.4.4 or later
- Upgrade