Skip to content
Threat Feed
Subscribe

Product

Composer/Getkirby/Cms (Vulnerable: <= 4.9.3)

1 brief RSS
high advisory

Kirby CMS Missing Authorization Vulnerability in /api/site/find (CVE-2026-54005)

An authenticated user can exploit CVE-2026-54005, a high-severity missing authorization vulnerability in Kirby CMS versions <= 4.9.3 and from 5.0.0-alpha.1 to <= 5.4.3, via the `/api/site/find` REST API route to bypass `pages.access` permissions and retrieve sensitive content and metadata from unauthorized pages.

composer/getkirby/cms +1 cms vulnerability kirby information-disclosure api webserver
2r 3t