Authorization Bypass in Kirby CMS Affects User Role Management
CVE-2026-40099
5.3MEDIUM
What is CVE-2026-40099?
Kirby, an open-source content management system, has a flaw in its user permissions management allowing authenticated users with the 'pages.create' permission to bypass the established editorial workflow. Until versions 4.9.0 and 5.4.0, Kirby did not enforce the 'changeStatus' permission during the page creation process. This oversight permitted attackers to create published pages directly via the REST API, circumventing the necessary review. The issue has since been addressed in the latest versions, which now require users to have 'pages.changeStatus' permission to publish new pages.
Affected Version(s)
kirby < 4.9.0 < 4.9.0
kirby >= 5.0.0, < 5.4.0 < 5.0.0, 5.4.0