CyberRota Analysis
AI-GeneratedKirby CMS versions prior to 4.9.4 and 5.4.4 are vulnerable to a permissions issue that allows authenticated users to exploit the pages field, enabling them to confirm the existence of arbitrary pages and retrieve their title field values, even if they lack access permissions. This could lead to information disclosure, potentially exposing sensitive content structure details. Organizations using affected versions of Kirby should prioritize upgrading to the latest versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4.