Kirby versions prior to 4.9.0 and between 5.0.0 and 5.4.0 lack proper authorization enforcement for read access to site, user, and role data. This missing authorization (CWE-862) means that users with limited privileges can read sensitive information that should be restricted. The vulnerability has a CVSS 4.0 base score of 7.1, indicating a high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality. The vulnerability was publicly disclosed on May 9, 2026, and fixed in versions 4.9.0 and 5.4.0.

Exploitation of this vulnerability allows unauthorized users to read sensitive site configuration, user, and role information that should be protected by permissions. This can lead to information disclosure that may facilitate further attacks or unauthorized access. There are no known exploits in the wild at the time of this report.

Upgrade affected Kirby installations to version 4.9.0 or later, or 5.4.0 or later, where this missing authorization issue has been patched. Since this is an open-source CMS and not a cloud service, remediation requires manual upgrade by the user. Patch status is confirmed by the vendor's versioning information.