Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
TL;DR
This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Impact
Kirby's user permissions control which user role is allowed to perform specific actions in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). The permissions control the authorization of user actions (with handling of model-specific authorization omitted here for brevity).
Kirby provides the access.system permission (among others) that controls access to the system area of the Kirby Panel. This area contains internal system information like the installed Kirby, plugin and server versions, security state and Kirby license. If the access.system permission is disabled for a user role, users of that role should not be able to access this internal system information. However it is also possible to access some system information via the /api/system REST API endpoint. In affected releases, the response of this endpoint for authenticated users contained the installed Kirby version and the status, type and code of the installed Kirby license. These values are considered sensitive information and should be protected by the access.system permission.
The installed Kirby version and license data can be used by malicious actors during reconnaissance when planning a separate attack.
Patches
The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have protected the version and license properties of the /api/system endpoint with a check for the existing access.system permission. This ensures that the REST API only outputs information that should be accessible to the user via the Panel.
Credits
Kirby thanks @HuajiHD and @0x-bala for responsibly reporting the identified issue.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | getkirby/cms | < 4.9.0, >= 5.0.0, < 5.4.0 | 4.9.0, 5.4.0 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-862- Platform
- Composer
- Package
getkirby/cms- Disclosed
- 04.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-x68m-c7jf-2572 - CC BY 4.0
Vulnerability history: getkirby/cms
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 51
- First → latest
- 12.2020 09.2026
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 19
- Medium 30
- Low 1
Disclosures per year
- 2020: 1
- 2021: 5
- 2022: 7
- 2023: 5
- 2024: 4
- 2025: 3
- 2026: 26
-
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.