7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54005

CVE-2026-54005: Kirby: `pages.access` permission is not checked in the `site/find` REST API route

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published pages through the /api/site/find route without authorization to access those pages. This issue is fixed in versions 4.9.4 and 5.4.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54005

CVE-2026-54005:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
getkirby/cms	composer	<= 4.9.3	4.9.4
getkirby/cms	composer	>= 5.0.0-alpha.1, <= 5.4.3	5.4.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-r3w8-2c5r-h9j9, allows authenticated users to bypass access controls and retrieve arbitrary page data via the /api/site/find REST API endpoint. By analyzing the commits between the vulnerable version 5.4.3 and the patched version 5.4.4, I identified the specific fix in commit b22d0b64b6478ce6871dc7ec3368d7afaf078688. The patch modifies the route definition in config/api/routes/site.php. The change is within the closure that acts as the action handler for the site/find route. The original code called $this->site()->find() and returned the data directly. The patched code adds a ->filter('isAccessible', true) call to the result set. This confirms that the vulnerability was a missing authorization check within this specific closure. Therefore, this closure is the vulnerable function, as it's the piece of code that improperly handles the user request and leads to the information disclosure.

Vulnerable functions

{closure}

config/api/routes/site.php

The vulnerability lies in an anonymous function (closure) that handles the '/api/site/find' POST route. This function directly returned the results of a page search using `$this->site()->find()` without verifying if the user had access permissions for the requested pages. This allowed any authenticated user to retrieve the content of any page by its ID, bypassing the `pages.access` permission check. The patch rectifies this by adding a `->filter('isAccessible', true)` call, which filters the results to include only pages the current user is authorized to view.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.