Kirby CMS, an open-source content management system, did not enforce the pages.access permission during page draft rendering in versions before 4.9.1 and 5.4.1. The vulnerability occurs because the path resolver for the CMS router allowed any authenticated user to render page drafts if they knew the full path, without verifying if the user had access rights to that specific page. This missing authorization (CWE-862) could expose sensitive unpublished content. The flaw was addressed in versions 4.9.1 and 5.4.1.

Authenticated users with knowledge of the full path to a page draft could view unpublished content they are not authorized to access. This unauthorized access could lead to premature disclosure of sensitive information such as unreleased products or posts. The vulnerability does not allow unauthenticated access and requires at least low-level privileges (authenticated user).

Upgrade Kirby CMS to version 4.9.1 or later, or 5.4.1 or later, where this authorization issue has been fixed. Patch status is not explicitly confirmed in the advisory, but the fix is indicated by the version numbers. No other mitigations are specified.