Missing Authorization in Kirby - CVE-2026-49274
Published: July 20, 2026
Vulnerability identifier: #VU138444
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-49274
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the page picker backend logic for the pages field when handling a user-provided parent page or site. A remote user can provide the full path to an existing page to disclose sensitive information.
Only the existence of arbitrary pages and the value of their title field can be retrieved. Write actions are not affected.
Affected software
Kirby
How to mitigate CVE-2026-49274
Install security update from vendor's website.
Kirby - addressed in versions 4.9.4, 5.4.4