Kirby CMS allows read access to sensitive site, user, and role information without enforcing any permissions. An attacker who can reach the public site can retrieve this data, potentially exposing usernames, roles, configuration settings, and other confidential details. This results in a confidentiality breach that could be leveraged in further attacks.

All Kirby CMS installations running version 4.x prior to 4.9.0, or version 5.x prior to 5.4.0 are affected. The vulnerability is present in the open-source distribution distributed by getkirby:kirby.

The CVSS score of 7.1 indicates a high severity. The EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The likely attack vector involves sending HTTP requests to exposed API endpoints that return site, user, or role data; this inference is based on the description that read access is unrestricted. Vulnerators can obtain confidential information without authentication, leading to a confidentiality breach.