The vulnerability is an authorization flaw where the CMS’s REST API allows any authenticated user with the pages.create permission to set the isDraft flag to false, creating published content without requiring changeStatus permission. This bypasses the intended editorial workflow and enables malicious users to publish or modify content. The flaw stems from how the system resolves permission checks independently, leading to a privilege escalation scenario, classified as CWE-1336.

Affected systems are installations of the Kirby content management system version 4.8.x and earlier, and version 5.3.x and earlier, before the release of 4.9.0 and 5.4.0 respectively. The vulnerability is present regardless of the front‑end or back‑end configuration, as long as the REST API is accessible.

The CVSS base score is 7.6, indicating moderate to high severity, but the EPSS score of less than 1% suggests an unlikely exploitation rate at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated access and the ability to send REST API requests, so the attack vector is authenticated. Once authenticated, the attacker can immediately publish new pages, causing potential reputational and compliance damage.