Kirby’s page creation API incorrectly allows the isDraft flag to be overridden, enabling any authenticated user with the pages.create permission to publish pages directly. Because the changeStatus permission is not enforced at page creation time, an attacker can add content that bypasses the normal editorial workflow and immediately makes it visible to all users. This can lead to accidental exposure of incomplete or inappropriate content and can be leveraged by malicious attackers to inject or modify site content without the oversight normally provided by editorial reviews.

The vulnerability affects all installations of the Kirby content management system running a version earlier than 4.9.0 or 5.4.0. Users who have configured roles with only the pages.create permission—without also granting pages.changeStatus—are at risk because the API does not check for the latter during page creation.

The CVSS score of 5.3 indicates moderate severity while the EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate and obtain the pages.create permission, then use the REST API’s unfiltered isDraft parameter to create a published page. Once posted, the page is immediately visible to all site visitors, providing an efficient vector for content injection or misinformation. The risk is highest when user roles are overly permissive or the CMS is exposed to a large user base.