CVE-2026-40099

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40099
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40099.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40099
Aliases
Published
2026-04-24T00:34:02.125Z
Modified
2026-07-08T08:12:33.804161653Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
Details

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. For pages, Kirby provides the pages.create and pages.changeStatus permissions (among others). Prior to versions 4.9.0 and 5.4.0, Kirby checked these permissions independently and only for the respective action. However the changeStatus permission didn't take effect on page creation. New pages are created as drafts by default and need to be published by changing the page status of an existing page draft. This is ensured when the page is created via the Kirby Panel. However the REST API allows to override the isDraft flag when creating a new page. This allowed authenticated attackers with the pages.create permission to immediately create published pages, bypassing the normal editorial workflow. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Kirby has added a check to the page creation rules that ensures that users without the pages.changeStatus permission cannot create published pages, only page drafts.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40099.json",
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/getkirby/kirby

Affected ranges

Type
GIT
Repo
https://github.com/getkirby/kirby
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d952dfc0a890979c863ec5fa11660e37400f0f4c
Introduced
2ff182ba39ddea19fa1615bd3733f734b5e53842
Fixed
80061614af90387da8b8ff9d92b390050a5f958f
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.9.0"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.4.0"
        }
    ]
}

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.2-rc.1
3.0.3
3.0.3-rc.1
3.0.3-rc.2
3.0.3-rc.3
3.1.0
3.1.0-rc.1
3.1.1
3.1.2
3.1.2-rc.1
3.1.3
3.1.3-rc.1
3.1.4
3.1.4-rc.1
3.2.0
3.2.0-rc.1
3.2.0-rc.2
3.2.0-rc.3
3.2.0-rc.4
3.2.1
3.2.1-rc.1
3.2.2
3.2.3-rc.1
3.2.5
3.2.5-rc.1
3.2.5-rc.2
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.4.0
3.4.1
3.4.2
3.5.0
3.5.0-rc.1
3.5.0-rc.2
3.5.0-rc.3
3.5.0-rc.4
3.5.0-rc.5
3.5.0-rc.6
3.5.0-rc.7
3.5.1
3.5.1-rc.1
3.5.2
3.5.3
3.5.3.1
3.5.4
3.5.5
3.5.6
3.5.7
3.5.7.1
3.6.0
3.6.1.1
3.6.2
3.6.2-rc.1
3.6.2-rc.2
3.6.2-rc.3
3.6.3
3.6.3.1
3.6.4
3.6.5
3.6.6
3.7.0
3.7.0.1
3.7.0.2
3.7.1
3.7.2
3.7.2.1
3.7.3
3.7.4
3.7.4-rc.1
3.7.5
3.8.0
3.8.1
3.8.1.1
3.8.2
3.8.3
3.8.4
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.6-rc.1
3.9.6.1
3.9.7
3.9.8
4.*
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0
4.1.1
4.1.2
4.2.0
4.3.0
4.3.1
4.4.0
4.4.1
4.5.0
4.6.0
4.6.1
4.7.0
4.7.1
4.7.2
4.8.0
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.3
5.3.0
5.3.1
5.3.2
5.3.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40099.json"