https://feed.craftedsignal.io/vendors/getkirby/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 30 Apr 2026 21:03:20 +0000https://feed.craftedsignal.io/briefs/2026-04-kirby-auth-bypass/Thu, 30 Apr 2026 21:03:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-kirby-auth-bypass/A missing authorization vulnerability in Kirby CMS allows authenticated users to bypass intended access restrictions on pages and files, potentially leading to unauthorized information disclosure and content modification; patched in versions 4.9.0 and 5.4.0.Kirby CMS versions prior to 4.9.0 and between 5.0.0 and 5.3.3 are vulnerable to a missing authorization flaw. This vulnerability impacts Kirby sites where user roles are intentionally configured with restricted access to pages or files through disabled pages.access, pages.list, files.access, or files.list permissions. The issue stems from inconsistent permission checks within the Kirby Panel and REST API, allowing authenticated users to access resources they should not be able to. Updating to versions 4.9.0, 5.4.0, or later resolves this vulnerability by implementing consistent permission checks. The vulnerability is identified as CVE-2026-42137.

Attack Chain

1. An authenticated user logs into the Kirby CMS Panel or REST API.
2. The user attempts to access a page or file for which their role lacks the necessary pages.access/files.access or pages.list/files.list permissions.
3. Due to inconsistent permission checks, the user can view the page or file details via the “changes” dialog in the Panel, even if listing is disabled.
4. The user accesses the REST API, which, despite direct access checks, fails to properly filter collections or related models (children, drafts, files, etc.).
5. The attacker views images associated with restricted site, pages, or user resources in lists within the Panel.
6. The user exploits the incorrect permission check (using pages.access instead of pages.list or files.access instead of files.list in specific API routes).
7. The user traverses to previous or next files using direct links in the files view, even if those files should not be listable.
8. The attacker gains unauthorized access to sensitive information or modifies content due to the bypassed permission checks.

Impact

This vulnerability allows authenticated users to bypass intended access restrictions within Kirby CMS, leading to potential unauthorized access to sensitive information and/or unauthorized content modification. The inconsistent permission checks in the Panel and REST API could result in unintended disclosure of data restricted by role-based access controls. Successful exploitation could compromise the confidentiality and integrity of the affected Kirby CMS instance. While the advisory does not list the number of victims, this flaw impacts any Kirby site with restricted roles.

Recommendation

• Upgrade to Kirby CMS version 4.9.0 or 5.4.0 (or later) to patch the vulnerability as recommended in the advisory.
• Review user role permissions and blueprint configurations to ensure appropriate access controls are in place after patching, as described in the overview.
• Monitor web server logs for unusual API requests to resources that should be restricted, using the rules below, to identify potential exploitation attempts.
• Implement rate limiting on API endpoints to mitigate potential brute-force attacks attempting to exploit this or other vulnerabilities.

]]>highadvisoryauthorizationcmsweb-applicationhttps://feed.craftedsignal.io/briefs/2026-04-kirby-ssti/Thu, 23 Apr 2026 21:24:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-04-kirby-ssti/A server-side template injection (SSTI) vulnerability exists in Kirby CMS within the option rendering feature due to double template resolution in option fields (checkboxes, color, multiselect, select, radio, tags, or toggles) when using options from a query or API with untrusted values, potentially allowing attackers to inject malicious queries.A server-side template injection (SSTI) vulnerability has been identified in Kirby CMS affecting sites using option fields (checkboxes, color, multiselect, select, radio, tags, or toggles) with options sourced from queries or APIs where the values cannot be fully trusted. This vulnerability, discovered and reported by @offset, stems from a double resolution of templates within the options rendering logic. An attacker with Panel access or through user interaction can inject malicious query templates. This can lead to unauthorized access to sensitive information (like user passwords) or malicious modification of site content. The vulnerability affects Kirby CMS versions prior to 4.9.0 and versions between 5.0.0 and 5.4.0.

Attack Chain

1. An attacker gains access to the Kirby Panel, or convinces a user with access to interact with a malicious element.
2. The attacker identifies a page or blueprint using dynamic options for form fields (checkboxes, selects, etc.) sourced from a query or API.
3. The attacker injects a malicious query template, such as {{ users.first.password }} or {{ page.delete }}, into a page title or data returned from an external API.
4. The administrator or another privileged user navigates to the affected Panel view, triggering the rendering of the form field with the injected malicious template.
5. The Kirby CMS options logic improperly double-resolves the template, executing the injected query.
6. The attacker gains access to sensitive information, such as user passwords, or triggers unauthorized actions like page deletion, depending on the injected query.
7. The attacker escalates privileges by exploiting the compromised user’s session or by directly accessing sensitive information.

Impact

Successful exploitation of this vulnerability could allow attackers to access sensitive site information, such as user credentials, or perform unauthorized actions, like modifying or deleting content. This could lead to a complete compromise of the Kirby CMS website and its data. The vulnerability specifically targets sites that leverage dynamic options for form fields, making them susceptible to malicious query injection. Sites running vulnerable versions of Kirby CMS are at risk of information disclosure and unauthorized modification.

Recommendation

• Upgrade to Kirby CMS version 4.9.0 or 5.4.0 or later to patch the vulnerability as described in the advisory (https://github.com/advisories/GHSA-jcjw-58rv-c452).
• Apply input validation and sanitization to all data sources used for dynamic options to prevent the injection of malicious templates and mitigate CVE-2026-34587.
• Monitor web server logs for suspicious activity, such as requests containing template syntax or attempts to access sensitive information, to identify potential exploitation attempts.

]]>highadvisorysstikirbytemplate-injection