{"id":"CVE-2026-41325","aliases":["GHSA-6gqr-mx34-wh8r"],"url":"https://o3.security/vulnerability/CVE-2026-41325","summary":"Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection","details":"### TL;DR\n\nThis vulnerability affects all Kirby sites where users of a particular role have no permission to create pages, files or users (`pages.create`, `files.create` or `users.create` permission is disabled). This can be due to configuration in the user blueprint(s), via `options` in the model blueprint(s) or via a combination of both settings.\n\n**This vulnerability is of high severity for affected sites.**\n\nDevelopers' Kirby sites are *not* affected if they intend all users of their site to be able to create pages, files and users. The vulnerability can only be exploited by authenticated users.\n\n----\n\n### Introduction\n\nAn authorization bypass allows authenticated users to perform actions they should not be allowed to perform based on their configured permissions, thereby causing a privilege escalation.\n\nThe effects of an authorization bypass can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.\n\n### Impact\n\nKirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions.\n\nKirby provides the `pages.create`, `files.create` and `users.create` permissions (among others). These permissions can again be set in the user blueprint and/or in the blueprint of the target model via `options`. In affected releases, Kirby allowed to override the `options` during the creation of pages, files and users by injecting custom dynamic blueprint configuration into the model data. The injected `options` could include `'create' => true`, which then caused an override of the permissions and options configured by the site developer in the user and model blueprints.\n\n### Patches\n\nThe problem has been patched in [Kirby 4.9.0](https://github.com/getkirby/kirby/releases/tag/4.9.0) and [Kirby 5.4.0](https://github.com/getkirby/kirby/releases/tag/5.4.0). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, we have updated the normalization code that is used during the creation of pages, files and users to include a filter for the `blueprint` property. This prevents the injection of dynamic blueprint configuration into the creation request.\n\n### Credits\n\nKirby thanks @offset for responsibly reporting the identified issue.","published":"2026-04-24T00:38:50.106Z","modified":"2026-08-12T03:51:13.654689998Z","cvss":null,"epss":{"score":0.00363,"percentile":0.29292,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"getkirby/cms","fixedVersion":"4.9.0"},{"ecosystem":"Packagist","name":"getkirby/cms","fixedVersion":"5.4.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/getkirby/kirby/releases/tag/4.9.0"},{"type":"WEB","url":"https://github.com/getkirby/kirby/releases/tag/5.4.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41325.json"},{"type":"ADVISORY","url":"https://github.com/getkirby/kirby/security/advisories/GHSA-6gqr-mx34-wh8r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41325"},{"type":"PACKAGE","url":"https://github.com/getkirby/kirby"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:13.654689998Z"}}