Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
TL;DR
This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Impact
Kirby's user permissions control which user role is allowed to perform specific actions in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). The permissions control the authorization of user actions (with handling of model-specific authorization omitted here for brevity).
Kirby provides the access.system permission (among others) that controls access to the system area of the Kirby Panel. This area contains internal system information like the installed Kirby, plugin and server versions, security state and Kirby license. If the access.system permission is disabled for a user role, users of that role should not be able to access this internal system information. However it is also possible to access some system information via the /api/system REST API endpoint. In affected releases, the response of this endpoint for authenticated users contained the installed Kirby version and the status, type and code of the installed Kirby license. These values are considered sensitive information and should be protected by the access.system permission.
The installed Kirby version and license data can be used by malicious actors during reconnaissance when planning a separate attack.
Patches
The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have protected the version and license properties of the /api/system endpoint with a check for the existing access.system permission. This ensures that the REST API only outputs information that should be accessible to the user via the Panel.
Credits
Kirby thanks @HuajiHD and @0x-bala for responsibly reporting the identified issue.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | getkirby/cms | < 4.9.0, >= 5.0.0, < 5.4.0 | 4.9.0, 5.4.0 |
Referencias
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N- Debilidad (CWE)
CWE-862- Plataforma
- Composer
- Paquete
getkirby/cms- Publicada
- 04.05.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-x68m-c7jf-2572 - CC BY 4.0
Historial de vulnerabilidades: getkirby/cms
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 51
- Primera → última
- 12.2020 09.2026
- Sin corrección
- 2
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 19
- Media 30
- Baja 1
Divulgaciones por año
- 2020: 1
- 2021: 5
- 2022: 7
- 2023: 5
- 2024: 4
- 2025: 3
- 2026: 26
-
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.