https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 10:03:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-316833 EUVD-2026-316833 https://cve.radiocsirt.org/vuln/euvd-2026-316833 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42137 <p>Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.</p> <p>Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42137 https://cve.radiocsirt.org/vuln/ghsa-85x2-r8xv-ww8c <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites where users of a particular role have no permission to access or list pages or files (`pages.access`, `pages.list`, `files.access` or `files.list` permission is disabled). This can be due to configuration in the user blueprint(s), via `options` in the model blueprint(s) or via a combination of both settings.</p> <p>**This vulnerability is of high severity for affected sites.**</p> <p>Consumers&#39; Kirby sites are *not* affected if they intend all users to be able to access all pages and files of the site. The vulnerability can only be exploited by authenticated users. Write actions are *not* affected by this vulnerability.</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Impact</p> <p>Kirby&#39;s user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.</p> <p>Kirby provides the `pages.access`, `pages.list`, `files.acce…</p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites where users of a particular role have no permission to access or list pages or files (`pages.access`, `pages.list`, `files.access` or `files.list` permission is disabled). This can be due to configuration in the user blueprint(s), via `options` in the model blueprint(s) or via a combination of both settings.</p> <p>**This vulnerability is of high severity for affected sites.**</p> <p>Consumers&#39; Kirby sites are *not* affected if they intend all users to be able to access all pages and files of the site. The vulnerability can only be exploited by authenticated users. Write actions are *not* affected by this vulnerability.</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Impact</p> <p>Kirby&#39;s user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.</p> <p>Kirby provides the `pages.access`, `pages.list`, `files.acce…</p> https://cve.radiocsirt.org/vuln/ghsa-85x2-r8xv-ww8c