Kirby: `pages.access` permission is not checked in the `site/find` REST API route (CVE-2026-54005) | HOL Guard CVE