Description
Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. Permissions are defined for each user role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. Kirby provides the pages.access and pages.list permissions (among others). The list permission controls whether affected models appear in lists throughout the Panel and REST API. The access permission has the same effect but also disables direct access to the affected models. This vulnerability affects the path resolver for the main CMS router. The resolver takes an input path from the requested URL and determines which model (page or file) should be rendered. When a path is requested that points to a page draft, the resolver checks that the request either contains a valid preview token or is authenticated by a valid user. In affected releases, Kirby allowed page drafts to be rendered if any valid user was authenticated, even if that user did not have access to the specific page model. Authenticated attackers with knowledge of the full path to an existing page draft could then access the rendered frontend page. This could lead to the disclosure of sensitive information, e.g. ahead of the launch of a new product or post. This issue has been fixed in versions 4.9.1 and 5.4.1.
Published: 2026-07-16
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Kirby is an open‑source content‑management system. Versions prior to 4.9.1 and 5.4.1 fail to enforce the pages.access permission when rendering page drafts. The path resolver, which translates a requested URL into a page or file model, requires either a valid preview token or an authenticated user, but in the affected releases it does not verify that the authenticated user actually has pages.access for the specific page model. Consequently, any authenticated user who knows the full URL of an unpublished draft can render and view the draft on the frontend, allowing disclosure of sensitive content before publication. This authorisation flaw matches CWE‑862.

Affected Systems

The vulnerability affects the Kirby content management system, specifically the getkirby:kirby product. Versions before 4.9.1 and 5.4.1 are impacted. Any user with authentication credentials who can reach the main CMS router and knows a draft URL can potentially exploit the flaw.

Risk and Exploitability

The CVSS score of 6.0 indicates moderate severity, while the EPSS score of less than 1% suggests limited current exploitation likelihood and the vulnerability is not listed in the CISA KEV catalog. The flaw requires authentication and knowledge of a draft URL, which are non‑trivial prerequisites, but once met the attacker can read the entire draft content. Consequently, the risk is moderate, and attention should be given to preventing unauthorized draft access until the patch is applied.

Generated by OpenCVE AI on July 31, 2026 at 01:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Kirby 4.9.1 or 5.4.1 (or later) to apply the vendor fix.
  • Restrict the pages.access permission in the user blueprint so that roles without draft viewing rights cannot access any page drafts.
  • Verify that direct rendering of unresolved draft URLs requires a valid preview token or that the request is blocked when the user lacks pages.access.

Generated by OpenCVE AI on July 31, 2026 at 01:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2xw4-v2wx-hqq9 Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
History

Fri, 17 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Getkirby
Getkirby kirby
Vendors & Products Getkirby
Getkirby kirby

Thu, 16 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. Permissions are defined for each user role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. Kirby provides the pages.access and pages.list permissions (among others). The list permission controls whether affected models appear in lists throughout the Panel and REST API. The access permission has the same effect but also disables direct access to the affected models. This vulnerability affects the path resolver for the main CMS router. The resolver takes an input path from the requested URL and determines which model (page or file) should be rendered. When a path is requested that points to a page draft, the resolver checks that the request either contains a valid preview token or is authenticated by a valid user. In affected releases, Kirby allowed page drafts to be rendered if any valid user was authenticated, even if that user did not have access to the specific page model. Authenticated attackers with knowledge of the full path to an existing page draft could then access the rendered frontend page. This could lead to the disclosure of sensitive information, e.g. ahead of the launch of a new product or post. This issue has been fixed in versions 4.9.1 and 5.4.1.
Title Kirby: `pages.access` permission is not checked during rendering of page drafts
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Getkirby Kirby
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-17T11:11:07.047Z

Reserved: 2026-05-05T14:39:34.923Z

Link: CVE-2026-44176

cve-icon Vulnrichment

Updated: 2026-07-17T11:11:00.931Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T01:15:18Z

Weaknesses