The vulnerability allows an authenticated user to retrieve sensitive license data and the installed version of the Kirby CMS via the system API endpoint. This flaw does not compromise code execution or remote access, but exposes internal configuration details that could assist an attacker in tailoring subsequent attacks. The weakness is a permission-check failure, matching CWE‑862. The impact is limited to information disclosure and does not immediately affect confidentiality or integrity beyond leaking configuration data.

Kirby CMS from getkirby:kirby is affected. Versions released before 4.9.0 and before 5.4.0 contain the flaw; versions 4.9.0 and 5.4.0 include the fix.

The CVSS score of 5.3 indicates a medium severity for the disclosed data. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no known public exploits. The attack requires authenticated access to the CMS, which the affected user already possesses for normal operations. Once authenticated, an attacker can easily access the system API to obtain the license information and CMS version, providing useful context for further targeted attacks.