### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (`pages.access` permission is disabled). This can be due to configuration in the user blueprint(s), `options` in the model blueprint(s), or a combination of both settings. It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the `/api/site/find` route without being authorized to access the respective pages. **This vulnerability is of high severity for affected sites.** Your Kirby sites are *not* affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are *not* affected by this vulnerability. ---- ### Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. ### Affected components The `/api/site/find` route allows callers to request model data for a collection of user-selected pages. This model data includes structural metadata about the page itself and its children, siblings, and files and can also be extended via a query parameter to return full page content and additional metadata. The pages to return can be queried by a list of page IDs and/or UUIDs. Draft pages are excluded from this route as it only supports querying published pages. ### Impact In affected releases, Kirby did not check whether the queried pages were accessible to the currently authenticated user. This can lead to disclosure of sensitive information contained in inaccessible pages, including the confirmation of the existence of individual pages as well as disclosure of sensitive content fields stored in the pages. Linked children, siblings, or files were *not* affected by this vulnerability as they were already properly filtered by the appropriate `pages.list` and `files.list` permissions. Because the `/api/site/find` route is read-only, the vulnerability does *not* allow malicious write access. ### Patches The problem has been patched in [Kirby 4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4) and [Kirby 5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability. In all of the mentioned releases, we added a filter ensuring that the `/api/site/find` route only returns pages that are accessible to the current user. ### Credits Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.
### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (`pages.access` permission is disabled). This can be due to configuration in the user blueprint(s), `options` in the model blueprint(s), or a combination of both settings. It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the `/api/site/find` route without being authorized to access the respective pages. **This vulnerability is of high severity for affected sites.** Your Kirby sites are *not* affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are *not* affected by this vulnerability. ---- ### Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. ### Affected components The `/api/site/find` route allows callers to request model data for a collection of user-selected pages. This model data includes structural metadata about the page itself and its children, siblings, and files and can also be extended via a query parameter to return full page content and additional metadata. The pages to return can be queried by a list of page IDs and/or UUIDs. Draft pages are excluded from this route as it only supports querying published pages. ### Impact In affected releases, Kirby did not check whether the queried pages were accessible to the currently authenticated user. This can lead to disclosure of sensitive information contained in inaccessible pages, including the confirmation of the existence of individual pages as well as disclosure of sensitive content fields stored in the pages. Linked children, siblings, or files were *not* affected by this vulnerability as they were already properly filtered by the appropriate `pages.list` and `files.list` permissions. Because the `/api/site/find` route is read-only, the vulnerability does *not* allow malicious write access. ### Patches The problem has been patched in [Kirby 4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4) and [Kirby 5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability. In all of the mentioned releases, we added a filter ensuring that the `/api/site/find` route only returns pages that are accessible to the current user. ### Credits Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.
Update getkirby/cms to 4.9.4; getkirby/cms to 5.4.4 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanKirby: `pages.access` permission is not checked in the `site/find` REST API route affects getkirby/cms (composer), getkirby/cms (composer). Severity is high. ### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (`pages.access` permission is disabled). This can be due to configuration in the user blueprint(s), `options` in the model blueprint(s), or a combination of both settings. It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the `/api/site/find` route without being authorized to access the respective pages. **This vulnerability is of high severity for affected sites.** Your Kirby sites are *not* affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are *not* affected by this vulnerability. ---- ### Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. ### Affected components The `/api/site/find` route allows callers to request model data for a collection of user-selected pages. This model data includes structural metadata about the page itself and its children, siblings, and files and can also be extended via a query parameter to return full page content and additional metadata. The pages to return can be queried by a list of page IDs and/or UUIDs. Draft pages are excluded from this route as it only supports querying published pages. ### Impact In affected releases, Kirby did not check whether the queried pages were accessible to the currently authenticated user. This can lead to disclosure of sensitive information contained in inaccessible pages, including the confirmation of the existence of individual pages as well as disclosure of sensitive content fields stored in the pages. Linked children, siblings, or files were *not* affected by this vulnerability as they were already properly filtered by the appropriate `pages.list` and `files.list` permissions. Because the `/api/site/find` route is read-only, the vulnerability does *not* allow malicious write access. ### Patches The problem has been patched in [Kirby 4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4) and [Kirby 5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability. In all of the mentioned releases, we added a filter ensuring that the `/api/site/find` route only returns pages that are accessible to the current user. ### Credits Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| getkirby/cmscomposer | <=4.9.3 | 4.9.4 |
| getkirby/cmscomposer | >=5.0.0-alpha.1,<=5.4.3 | 5.4.4 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate getkirby/cms to 4.9.4; getkirby/cms to 5.4.4 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanKirby: `pages.access` permission is not checked in the `site/find` REST API route affects getkirby/cms (composer), getkirby/cms (composer). Severity is high. ### TL;DR This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (`pages.access` permission is disabled). This can be due to configuration in the user blueprint(s), `options` in the model blueprint(s), or a combination of both settings. It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the `/api/site/find` route without being authorized to access the respective pages. **This vulnerability is of high severity for affected sites.** Your Kirby sites are *not* affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are *not* affected by this vulnerability. ---- ### Introduction Missing authorization allows authenticated users to perform actions they are not intended to have access to. The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information. ### Affected components The `/api/site/find` route allows callers to request model data for a collection of user-selected pages. This model data includes structural metadata about the page itself and its children, siblings, and files and can also be extended via a query parameter to return full page content and additional metadata. The pages to return can be queried by a list of page IDs and/or UUIDs. Draft pages are excluded from this route as it only supports querying published pages. ### Impact In affected releases, Kirby did not check whether the queried pages were accessible to the currently authenticated user. This can lead to disclosure of sensitive information contained in inaccessible pages, including the confirmation of the existence of individual pages as well as disclosure of sensitive content fields stored in the pages. Linked children, siblings, or files were *not* affected by this vulnerability as they were already properly filtered by the appropriate `pages.list` and `files.list` permissions. Because the `/api/site/find` route is read-only, the vulnerability does *not* allow malicious write access. ### Patches The problem has been patched in [Kirby 4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4) and [Kirby 5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability. In all of the mentioned releases, we added a filter ensuring that the `/api/site/find` route only returns pages that are accessible to the current user. ### Credits Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| getkirby/cmscomposer | <=4.9.3 | 4.9.4 |
| getkirby/cmscomposer | >=5.0.0-alpha.1,<=5.4.3 | 5.4.4 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard