Kirby CMS allows developers to define granular permissions in user and model blueprints. Prior to version 4.9.0 of the 4.x line and 5.4.0 of the 5.x line, the system permitted the injection of dynamic blueprint configuration into page, file, or user creation requests. An attacker could embed custom options that set a 'create' flag to true, thereby overriding the intended permissions and enabling creation of content or users without the required role. The vulnerability is categorized as CWE-863, improper authorization.

The vulnerability applies to the open-source Kirby CMS product from getkirby:kirby. All releases before 4.9.0 and before 5.4.0 are vulnerable. Any installation that uses the default or custom page, file, or user blueprints where the 'options' feature is enabled is affected.

The CVSS score of 7.1 indicates a high severity. The EPSS score of less than 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the ability to submit a creation request that includes custom blueprint configuration. Because the attacker can manipulate the data sent during creation, the threat is to permit unauthorized creation of pages, files, or users with elevated permissions.