Incorrect authorization in Kirby - CVE-2026-40099
Published: April 23, 2026
Vulnerability identifier: #VU127195
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40099
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create published pages without authorization.
The vulnerability exists due to incorrect authorization in the page creation API when handling page creation requests with an overridden isDraft parameter. A remote user can send a crafted API request to create published pages without authorization.
The issue affects sites where users are allowed to create pages but are not allowed to change page status.
Affected software
Kirby
How to mitigate CVE-2026-40099
Install security update from vendor's website.
Kirby - addressed in versions 4.9.0, 5.4.0