Kirby Missing Permission Checks in Panel and REST API

A vulnerability exists in Kirby, an open-source content management system, prior to versions 4.9.0 and 5.4.0, where `pages.access/list` and `files.access/list` permissions are not consistently enforced in the Panel and REST API. This issue allows authenticated users to access or list pages and files they should not have permission to. The vulnerability can be attributed to missing authorization checks, which could lead to unauthorized access to sensitive information or unauthorized changes to content.

Impact

The vulnerability can result in unauthorized access to non-listable pages and files, allowing affected users to bypass permission restrictions and access or manipulate content they should not be able to.

Remediation

Users are advised to upgrade to Kirby versions 4.9.0 or 5.4.0. Instructions for updating can be found in the Kirby release notes on GitHub.