https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 20:01:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-336183 EUVD-2026-336183 https://cve.radiocsirt.org/vuln/euvd-2026-336183 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49274 <p>Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4.</p> <p>Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49274 https://cve.radiocsirt.org/vuln/ghsa-23q2-54qv-rq5x <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites that use the `pages` field and where users of a particular role have no permission to access pages (`pages.access` permission is disabled). This can be due to configuration in the user blueprint(s), `options` in the model blueprint(s), or a combination of both settings.</p> <p>It was possible to confirm the existence of arbitrary pages and to retrieve the value of the title field of the pages found.</p> <p>The vulnerability can only be exploited by authenticated users. Write actions are *not* affected by this vulnerability.</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Affected components</p> <p>Kirby&#39;s user permissions control which user role is allowed to perform specific actions on content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.</p> <p>Kirby provides the `pages.access` and `pages.list` permissions (among others). The `list` permission controls whether affected models appear in l…</p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites that use the `pages` field and where users of a particular role have no permission to access pages (`pages.access` permission is disabled). This can be due to configuration in the user blueprint(s), `options` in the model blueprint(s), or a combination of both settings.</p> <p>It was possible to confirm the existence of arbitrary pages and to retrieve the value of the title field of the pages found.</p> <p>The vulnerability can only be exploited by authenticated users. Write actions are *not* affected by this vulnerability.</p> <p>----</p> <p>### Introduction</p> <p>Missing authorization allows authenticated users to perform actions they are not intended to have access to.</p> <p>The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.</p> <p>### Affected components</p> <p>Kirby&#39;s user permissions control which user role is allowed to perform specific actions on content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.</p> <p>Kirby provides the `pages.access` and `pages.list` permissions (among others). The `list` permission controls whether affected models appear in l…</p> https://cve.radiocsirt.org/vuln/ghsa-23q2-54qv-rq5x