Missing Authorization in Kirby - CVE-2026-54005
Published: July 20, 2026
Vulnerability identifier: #VU138440
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54005
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in the /api/site/find REST API route when handling requests for page IDs or UUIDs. A remote user can request arbitrary pages to disclose sensitive information.
Exploitation requires authentication and knowledge or guessing of page IDs or UUIDs. Only published pages are exposed, and write actions are not affected.
Affected software
Kirby
How to mitigate CVE-2026-54005
Install security update from vendor's website.
Kirby - addressed in versions 4.9.4, 5.4.4