Missing Authorization in Kirby - CVE-2026-49274
Published: July 20, 2026
Vulnerability identifier: #VU138444
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-49274
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ian Stewart
Affected software:
Kirby
Kirby
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the page picker backend logic for the pages field when handling a user-provided parent page or site. A remote user can provide the full path to an existing page to disclose sensitive information.
Only the existence of arbitrary pages and the value of their title field can be retrieved. Write actions are not affected.
How to mitigate CVE-2026-49274
Install security update from vendor's website.