CVE-2026-40099: 
PHP vulnerability analysis and mitigation

CVE-2026-40099 is an incorrect authorization vulnerability in Kirby CMS (open-source PHP content management system) that allows authenticated users with the pages.create permission to bypass the pages.changeStatus permission restriction and immediately publish pages — circumventing the intended editorial draft workflow. It affects all Kirby versions prior to 4.9.0 and versions 5.0.0 through 5.3.3 (prior to 5.4.0). The vulnerability was disclosed on April 23, 2026, by researcher @offset via responsible disclosure. It carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, Kirby Advisory).

The root cause is CWE-863 (Incorrect Authorization): Kirby's page creation logic evaluated the pages.create and pages.changeStatus permissions independently, without enforcing the changeStatus check during page creation. While the Kirby Panel UI enforces the draft-first workflow, the REST API accepts an unfiltered isDraft parameter that can be set to false when creating a new page. An authenticated attacker with only the pages.create permission can craft a direct REST API request with isDraft=false, causing the CMS to immediately publish the page without triggering the changeStatus permission check. The fix in versions 4.9.0 and 5.4.0 adds an explicit check in the page creation rules to prevent users lacking pages.changeStatus from creating published pages (GitHub Advisory, Kirby Advisory).

Exploitation allows authenticated users to bypass editorial approval workflows and publish content directly to a live Kirby site without the required pages.changeStatus permission. The primary impact is an integrity violation — unauthorized content can be published publicly, undermining content governance and editorial controls. There is no confidentiality or availability impact, and the vulnerability is scoped to the affected Kirby instance with no evidence of lateral movement potential (GitHub Advisory, Kirby Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires authenticated access with the pages.create permission, limiting the attacker pool to existing CMS users. The EPSS score is approximately 0.028% (8th percentile), indicating a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authenticate: Log in to the target Kirby CMS instance using credentials for an account that has the pages.create permission but lacks the pages.changeStatus permission.
2. Identify the REST API endpoint: Locate the Kirby REST API page creation endpoint, typically at /api/pages or a similar path depending on the site configuration.
3. Craft the malicious request: Construct an HTTP POST request to the page creation API endpoint, including the standard page creation payload (title, slug, template, etc.) and explicitly setting the isDraft parameter to false.
4. Submit the request: Send the crafted API request with valid authentication credentials (e.g., session cookie or API token).
5. Verify publication: Confirm that the newly created page is immediately published on the live site, bypassing the draft workflow and any editorial approval process that would normally require pages.changeStatus permission (Kirby Advisory, GitHub Advisory).

• Network: Unexpected HTTP POST requests to the Kirby REST API page creation endpoint (e.g., /api/pages) from authenticated low-privilege user accounts, particularly with isDraft=false or equivalent payload parameters.
• Logs: Kirby access logs showing page creation API calls from user accounts that do not have pages.changeStatus permission; newly published pages appearing without a corresponding status-change log entry.
• Content: Pages appearing in the published state that were created by users whose role blueprints restrict pages.changeStatus; unexpected content published without editorial review or approval records.

Update Kirby CMS to version 4.9.0 (for Kirby 4.x users) or 5.4.0 (for Kirby 5.x users), both released on April 23, 2026. Kirby recommends upgrading to Kirby 5 where possible; version 4.9.0 is provided as a security backport for sites that cannot migrate immediately. As a post-patch remediation step, administrators should audit all pages created by users with pages.create but restricted pages.changeStatus permissions to identify any unauthorized published content. If the old behavior (allowing published page creation but blocking status changes to existing pages) is required, Kirby recommends enabling the changeStatus permission and enforcing restrictions via a page.changeStatus:before hook (Kirby Advisory, Release 4.9.0, Release 5.4.0).

The vulnerability was responsibly reported by researcher @offset and disclosed by Kirby maintainer bastianallgeier on April 23, 2026, as part of a broader security release (Kirby 5.4.0) that addressed six CVEs simultaneously. The coordinated disclosure and same-day patch release were noted positively in the community. No significant independent media coverage or notable social media controversy has been identified beyond standard CVE tracking and aggregator activity (Kirby Advisory, Release 5.4.0).