CVE-2026-49274

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49274", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-28T20:07:58.860Z", "datePublished": "2026-07-09T18:38:32.436Z", "dateUpdated": "2026-07-14T01:10:30.223Z"}, "containers": {"cna": {"title": "Kirby: `pages.access` permission is not checked in the pages picker for parent pages", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x"}, {"name": "https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55"}, {"name": "https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c"}, {"name": "https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f"}, {"name": "https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1"}, {"name": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/4.9.4"}, {"name": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/5.4.4"}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"version": "< 4.9.4", "status": "affected"}, {"version": ">= 5.0.0, < 5.4.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-09T18:38:32.436Z"}, "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4."}], "source": {"advisory": "GHSA-23q2-54qv-rq5x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T01:10:20.203787Z", "id": "CVE-2026-49274", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T01:10:30.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49274", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T01:10:20.203787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T01:10:26.324Z"}}], "cna": {"title": "Kirby: `pages.access` permission is not checked in the pages picker for parent pages", "source": {"advisory": "GHSA-23q2-54qv-rq5x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}], "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x", "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55", "name": "https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c", "name": "https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f", "name": "https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1", "name": "https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "name": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "name": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-09T18:38:32.436Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49274", "state": "PUBLISHED", "dateUpdated": "2026-07-14T01:10:30.223Z", "dateReserved": "2026-05-28T20:07:58.860Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-09T18:38:32.436Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de las versiones 4.9.4 y 5.4.4, los sitios de Kirby que utilizaban el campo pages con roles que ten\u00edan el permiso pages.access deshabilitado permit\u00edan a los usuarios autenticados proporcionar una p\u00e1gina padre o sitio inaccesible al backend del selector de p\u00e1ginas y confirmar la existencia de p\u00e1ginas arbitrarias y recuperar los valores del campo title. Este problema est\u00e1 solucionado en las versiones 4.9.4 y 5.4.4."}], "id": "CVE-2026-49274", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49274", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T01:10:20.203787Z", "version": "2.0.3"}}]}, "published": "2026-07-09T19:17:05.490", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/3f4398cdcf9f50f84fdac52ad78a7a85fb31589f"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/bffffce6c081f69c46163cc89b1fd18ccf2a18d1"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/releases/tag/4.9.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/releases/tag/5.4.4"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kirby", "source": "cna", "vendor": "getkirby"}, "product": "kirby", "vendor": "getkirby"}], "created": "2026-07-09T20:45:03.719304+00:00", "updated": "2026-08-01T14:15:03.798493+00:00", "vendors": ["getkirby", "getkirby$PRODUCT$kirby"]}