Missing Authorization in Kirby - CVE-2026-54005
Published: July 20, 2026
Vulnerability identifier: #VU138440
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-54005
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ian Stewart
Affected software:
Kirby
Kirby
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in the /api/site/find REST API route when handling requests for page IDs or UUIDs. A remote user can request arbitrary pages to disclose sensitive information.
Exploitation requires authentication and knowledge or guessing of page IDs or UUIDs. Only published pages are exposed, and write actions are not affected.
How to mitigate CVE-2026-54005
Install security update from vendor's website.