CVE-2026-54005 is a missing authorization vulnerability (CWE-862) in the Kirby content management system. Before versions 4.9.4 and 5.4.4, authenticated users whose roles do not have the pages.access permission disabled can bypass authorization controls to retrieve full content and metadata of arbitrary published pages by accessing the /api/site/find endpoint with known or guessed page identifiers. This allows unauthorized disclosure of page data. The vulnerability is fixed in Kirby versions 4.9.4 and 5.4.4.

Authenticated users without the pages.access permission can access sensitive page content and metadata for arbitrary published pages. This leads to unauthorized information disclosure, potentially exposing confidential or sensitive site content to users who should not have access. There is no indication of privilege escalation or modification capabilities, but the confidentiality of published page data is compromised.

Upgrade Kirby to version 4.9.4 or later, or 5.4.4 or later, where this authorization issue is fixed. No other mitigation or temporary workaround is indicated. Patch status is not explicitly stated but the fix is included in these versions.