PT-2026-34817 · Kirby · Kirby

Offset · Published 2026-04-23 · Updated 2026-04-28 · CVE-2026-40099

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.0 Kirby versions prior to 5.4.0

Description An authorization bypass allows authenticated users to perform actions beyond their configured permissions, leading to privilege escalation. In the REST API, the isDraft flag can be overridden during the creation of a new page. This allows authenticated attackers who possess the pages.create permission, but lack the pages.changeStatus permission, to create published pages immediately. This bypasses the standard editorial workflow where new pages are typically created as drafts and require a status change to be published.

Recommendations Update Kirby to version 4.9.0 or later. Update Kirby to version 5.4.0 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-40099

GHSA-W942-J9R6-HR6R

Affected Products

Kirby

References · 9

• https://github.com/getkirby/kirby/security/advisories/GHSA-w942-j9r6-hr6r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w942-j9r6-hr6r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40099 · Security Note
• https://github.com/getkirby/kirby/releases/tag/5.4.0 · Note
• https://github.com/getkirby/kirby/releases/tag/4.9.0 · Note
• https://github.com/getkirby/kirby · Note
• https://twitter.com/CVEnew/status/2048099340502053147 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sug4za/resumen_diario_de_vulnerabilidades_24042026 · Reddit Post
• https://twitter.com/_cvereports/status/2049063765199425728 · Twitter Post