{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/kirby-cms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kirby CMS"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","privilege-escalation","web-application"],"_cs_type":"advisory","_cs_vendors":["getkirby"],"content_html":"\u003cp\u003eA high-severity authorization bypass vulnerability has been identified in Kirby CMS versions prior to 4.9.0 and between 5.0.0 and 5.4.0. The vulnerability allows authenticated users to perform actions they should not be authorized to perform, such as creating pages, files, or users, even if their roles lack the necessary permissions (\u003ccode\u003epages.create\u003c/code\u003e, \u003ccode\u003efiles.create\u003c/code\u003e, or \u003ccode\u003eusers.create\u003c/code\u003e). This bypass occurs due to the injection of custom dynamic blueprint configurations into the model data during the creation process. By manipulating the \u003ccode\u003eoptions\u003c/code\u003e parameter, an attacker can override intended permissions and options configured by the site developer in the user and model blueprints. The vulnerability was reported by @offset and patched in Kirby 4.9.0 and 5.4.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker authenticates to the Kirby CMS with a valid user account that lacks the \u003ccode\u003epages.create\u003c/code\u003e, \u003ccode\u003efiles.create\u003c/code\u003e, or \u003ccode\u003eusers.create\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP request to create a new page, file, or user.\u003c/li\u003e\n\u003cli\u003eThe malicious request injects a custom dynamic blueprint configuration into the model data via the \u003ccode\u003eoptions\u003c/code\u003e parameter. This injected configuration includes \u003ccode\u003e'create' =\u0026gt; true\u003c/code\u003e, effectively overriding the default permission settings.\u003c/li\u003e\n\u003cli\u003eKirby CMS processes the request without properly sanitizing or validating the injected blueprint configuration.\u003c/li\u003e\n\u003cli\u003eThe injected \u003ccode\u003eoptions\u003c/code\u003e parameter overrides the permissions configured in the user blueprint and/or the blueprint of the target model.\u003c/li\u003e\n\u003cli\u003eThe system incorrectly authorizes the user to create the page, file, or user, despite their role not having the necessary permissions.\u003c/li\u003e\n\u003cli\u003eThe new page, file, or user is successfully created with the attacker's injected configuration.\u003c/li\u003e\n\u003cli\u003eThe attacker has successfully escalated their privileges and can now perform actions they were not intended to perform.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows authenticated users to bypass intended permission controls and perform unauthorized actions within the Kirby CMS. This can lead to unauthorized content creation, modification, or deletion, potentially compromising the integrity and confidentiality of the website. An attacker could create administrative accounts, modify critical pages, or upload malicious files, leading to a full compromise of the Kirby CMS instance. The severity is high because any authenticated user can exploit it if the site is misconfigured.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to Kirby CMS version 4.9.0 or 5.4.0 or later to apply the patch that filters the \u003ccode\u003eblueprint\u003c/code\u003e property during the creation of pages, files, and users.\u003c/li\u003e\n\u003cli\u003eReview user and model blueprints to ensure permissions are correctly configured, specifically for \u003ccode\u003epages.create\u003c/code\u003e, \u003ccode\u003efiles.create\u003c/code\u003e, and \u003ccode\u003eusers.create\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to endpoints responsible for creating pages, files, or users.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect Kirby CMS Blueprint Injection\u003c/code\u003e to detect attempts to inject dynamic blueprint configurations via HTTP requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-25T12:00:00Z","date_published":"2026-04-25T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2026-04-25-kirby-auth-bypass/","summary":"An authorization bypass vulnerability in Kirby CMS allows authenticated users to perform actions they should not be allowed to perform based on their configured permissions by injecting custom dynamic blueprint configuration into the model data, leading to privilege escalation.","title":"Kirby CMS Authorization Bypass via Blueprint Injection","url":"https://feed.craftedsignal.io/briefs/2026-04-25-kirby-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Kirby CMS","version":"https://jsonfeed.org/version/1.1"}