CVE-2026-45334: Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions ### TL;DR This vulnerability affects all Kirby…

medium

Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

### TL;DR

This vulnerability affects all Kirby sites that restrict the visibility of users for certain roles via the `users.access` or `users.list` permissions. A site is affected if users of a particular role are not allowed to see other users in the Panel, for example because the role's blueprint sets `users.access: false` or `users.list: false` as permission for the authenticated user role and/or as option for the target user role.

A Kirby site is *not* affected if all authenticated Panel users are permitted to access and list other users. The vulnerability can only be exploited by authenticated users.

---

### Introduction

Missing authorization allows authenticated users to gain access to information they are not intended to see.

The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.

### Affected components

Kirby's user permissions control which user role is allowed to perform specific actions or access specific information in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). The `users.access` and `users.list` permissions control whether users of a given role are allowed to access and list other users in the Panel. It is also possible to customize the permissions for each target role using the `options` feature. The permissions and options together control the authorization of user actions.

Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a use

Affected

2 ranges

Vendor	Product	Version range	Fixed in
getkirby	cms	>= 0 < 4.9.1	4.9.1
getkirby	cms	>= 5.0.0 < 5.4.1	5.4.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.