Kirby CMS versions prior to 4.9.0 and versions from 5.0.0 up to but not including 5.4.0 have inconsistent enforcement of the `pages.access/list` and `files.access/list` permissions in the Panel and REST API. Authenticated users with roles that lack these permissions may still see or access pages and files they should not. This vulnerability does not affect write actions and only impacts sites where access restrictions are configured. The issue has been fixed in Kirby 4.9.0 and 5.4.0.