Description
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getkirby | kirby | < 4.9.0, >= 5.0.0, < 5.4.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | getkirby/cms | < 4.9.0 | 4.9.0 | GHSA-85x2-r8xv-ww8c |
| Packagist | getkirby/cms | >= 5.0.0, < 5.4.0 | 5.4.0 | GHSA-85x2-r8xv-ww8c |