The updated description confirms that Kirby sites using the pages field with roles that lack the pages.access permission let authenticated users provide an inaccessible parent page or site to the page picker backend. The backend verifies the existence of that parent and returns its title, enabling the attacker to enumerate arbitrary page existence and retrieve page titles beyond the user's authorized scope. This exposure is an information disclosure vulnerability that can aid reconnaissance and enumeration of pages. The flaw applies only to sites running versions earlier than 4.9.4 or 5.4.4.

All Kirby installations running versions earlier than 4.9.4 (for the 4.x series) or 5.4.4 (for the 5.x series) are affected. The issue is present in the getkirby:kirby product. Users of these versions should verify which roles have the pages.access permission disabled and update the CMS accordingly.

The CVSS score of 5.3 places the vulnerability in the medium category, reflecting its limited scope. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The attack requires a legitimate authenticated session with a role that lacks pages.access permission, which is a relatively narrow condition. Because the flaw merely reveals page titles and existence, exploitation does not lead to wider system compromise or data theft, but it can aid enumeration and reconnaissance efforts by an attacker.