The vulnerability lies in Kirby CMS’ content changes API missing permission checks between versions 5.0.0 and 5.2.1, allowing users who normally lack write permissions to submit updates. Attackers with API access can modify or delete site content, bypassing configured role restrictions. This results in unintended content tampering and potential data loss.

Kirby CMS version 5.0.0 through 5.2.1 installed on sites with modified permission settings. The vulnerability applies to all installations of the open‑source Kirby CMS during that version range, particularly those that have disabled the required update permission for certain roles.

The vulnerability has a CVSS score of 5.8, indicating moderate severity, and an EPSS score of less than 1%, implying a very low probability of exploitation. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector involves making authenticated or possibly unauthenticated API calls to the content changes endpoint on a site where write permissions have been disabled for certain roles; the attacker can then issue write operations that bypass authorization checks.