https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 16:50:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-317415 EUVD-2026-317415 https://cve.radiocsirt.org/vuln/euvd-2026-317415 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42069 <p>Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.</p> <p>Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42069 https://cve.radiocsirt.org/vuln/ghsa-2h7v-4372-f6x2 <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.</p> <p>**This vulnerability is of high severity for affected sites.**</p> <p>Sites using Kirby are *not* affected if they intend all users of the site to be able to list and access the site model and all users and roles, including the content stored within these models. Write actions are *not* affected by this vulnerability as they were gated by permissions before.</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Impact</p> <p>Kirby&#39;s user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.</p> <p>In affected releases, Kirby did not provide permission settings that control the access to the site model as well as to users and user roles. If the site developer disabled all permissions via the wildcard `&#34;*&#34;: false` setting, this only dis…</p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.</p> <p>**This vulnerability is of high severity for affected sites.**</p> <p>Sites using Kirby are *not* affected if they intend all users of the site to be able to list and access the site model and all users and roles, including the content stored within these models. Write actions are *not* affected by this vulnerability as they were gated by permissions before.</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Impact</p> <p>Kirby&#39;s user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.</p> <p>In affected releases, Kirby did not provide permission settings that control the access to the site model as well as to users and user roles. If the site developer disabled all permissions via the wildcard `&#34;*&#34;: false` setting, this only dis…</p> https://cve.radiocsirt.org/vuln/ghsa-2h7v-4372-f6x2