getkirby Kirby up to 4.9.0/5.4.0 Content-Locking Feature permission

Summaryinfo

A vulnerability has been found in getkirby Kirby up to 4.9.0/5.4.0 and classified as problematic. This issue affects some unknown processing of the component Content-Locking Feature. This manipulation causes permission. The identification of this vulnerability is CVE-2026-45334. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in getkirby Kirby up to 4.9.0/5.4.0 and classified as problematic. Affected by this vulnerability is an unknown part of the component Content-Locking Feature. The manipulation with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality. The summary by CVE is:

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently locked by another user. This allowed a low-privilege authenticated Panel user, whose role was configured with users.access: false or users.list: false, to learn the email address and identifier of any user who currently had a model open for editing in the Panel, including administrators and other higher-privilege users. Content locks are active for a configurable window (10 minutes by default). The email address can allow admin account enumeration, target phishing, and feed credential-stuffing attacks against the Kirby installation or other sites. The internal user ID can be cross-referenced with other endpoints once the requester has obtained a higher privilege through unrelated means. This issue has been fixed in versions 4.9.1 and 5.4.1.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-45334 since 05/11/2026. The exploitation appears to be easy. The attack can be launched remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 4.9.1 or 5.4.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• getkirby

Name

• Kirby

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9.0
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4.0

Website

• Product: https://github.com/getkirby/kirby/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion