[MEDIUM] Kirby: `pages.access` permission is not checked in the pages picker for parent pages

PKSA-4ys7-5twb-r3bn CVE-2026-49274 GHSA-23q2-54qv-rq5x

Affected package: getkirby/cms

Affected version: >=5.0.0-alpha.1,<=5.4.3|<=4.9.3

Reported by:
GitHub