Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published pages through the /api/site/find route without authorization to access those pages. This issue is fixed in versions 4.9.4 and 5.4.4.

Getkirby Kirby CMS prior to version 4.9.4 and prior to 5.4.4 is affected. Users running these versions should upgrade to 4.9.4 or 5.4.4 to remediate the issue.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. At the time of analysis, an attacker only needs to be authenticated and know or guess a page ID or UUID. Once authenticated, the attacker can invoke the /api/site/find endpoint and retrieve arbitrary page data without additional permissions; however, the overall chance of exploitation remains low according to the EPSS metric.