Kirby is an open‑source CMS. In versions prior to 4.9.4 and 5.4.4, the /api/site/find REST endpoint did not enforce the pages.access permission. As a result, any authenticated user who knew or could guess a page ID or UUID could retrieve the full content and metadata of any published page, even though the target role had pages.access disabled. This flaw allowed unauthorized exposure of page data and was fixed in releases 4.9.4 and 5.4.4.

Getkirby Kirby CMS versions earlier than 4.9.4 or 5.4.4 are vulnerable. Site owners running those versions should upgrade to 4.9.4 or 5.4.4 to eliminate the risk.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. The EPSS score of < 1% suggests a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. An attacker only needs to be authenticated and know or guess a page identifier; once authenticated, the attacker can invoke /api/site/find and retrieve arbitrary page data without additional permissions. The overall risk remains moderate, but the potential for data leakage warrants prompt remediation.