The vulnerability arises because Kirby's REST API and back‑end panel do not enforce permissions consistently on the pages.access/list and files.access/list endpoints. Based on the description, it is inferred that attackers who can reach these URLs—whether through a normal authenticated session or via an exposed API endpoint—can retrieve full listings of pages or files that they normally would not be allowed to view. This bypasses the intended authorization controls (CWE‑862, CWE‑863) and can expose sensitive content and aid further exploitation.

The issue affects the open‑source Kirby Content Management System distributed by getkirby. All installations running a version earlier than 4.9.0 (including the 4.x series) and earlier than 5.4.0 (including the 5.x series) are vulnerable. The fix is included in releases 4.9.0 and 5.4.0.

The CVSS base score of 7.1 indicates a high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability can be exploited remotely via the web interface or REST API by any user who can reach the endpoints, even if the user has only basic authenticated access. Once accessed, the attacker could enumerate site structure and files, potentially facilitating additional attacks.