5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45334

CVE-2026-45334: Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

TL;DR

This vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the users.access or users.list permissions. A site is affected if users of a particular role are not allowed to see other users in the Panel, for example because the role's blueprint sets users.access: false or users.list: false as permission for the authenticated user role and/or as option for the target user role.

A Kirby site is not affected if all authenticated Panel users are permitted to access and list other users. The vulnerability can only be exploited by authenticated users.

Introduction

Missing authorization allows authenticated users to gain access to information they are not intended to see.

The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.

Affected components

Kirby's user permissions control which user role is allowed to perform specific actions or access specific information in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). The users.access and users.list permissions control whether users of a given role are allowed to access and list other users in the Panel. It is also possible to customize the permissions for each target role using the options feature. The permissions and options together control the authorization of user actions.

Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently locked by another user.

Impact

In affected releases, this lock information was returned without checking whether the requesting user had permission to access or list the locking user.

Miggo Vulnerability Database

→

CVE-2026-45334

CVE-2026-45334:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
getkirby/cms	composer	<= 4.9.0	4.9.1
getkirby/cms	composer	>= 5.0.0, <= 5.4.0	5.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Kirby CMS's content locking feature, which disclosed user IDs and emails without proper authorization checks. Authenticated users with restricted permissions could obtain sensitive information (ID and email) of any user who had a page open for editing, including administrators. The analysis of the patches for versions 4.9.1 and 5.4.1 pinpointed the exact functions responsible. In older versions (<=4.9.0), the Kirby\Cms\ContentLock::get() function was the culprit. In newer versions (>=5.0.0), the logic was moved to Kirby\Content\Lock::toArray(). Both functions were patched to include a permission check (isListable()) before returning user data. This ensures that a user's details are only exposed if the requesting user has the necessary permissions, thus mitigating the information disclosure vulnerability.

Vulnerable functions

Kirby\Cms\ContentLock::get

src/Cms/ContentLock.php

This function retrieves content lock information. Before the patch, it returned the locking user's ID and email without checking if the requesting user had permission to view them. The patch adds a check using `isListable()` and returns null for user details if the check fails.

Kirby\Content\Lock::toArray

src/Content/Lock.php

This function serializes lock information to an array. Before the patch, it included the locking user's ID and email without checking for permissions. The patch adds a check using `isListable()` to ensure the requesting user is allowed to see the locking user's details.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.