Kirby CMS User Creation API Permission Bypass Vulnerability

A vulnerability exists in Kirby CMS versions through 4.8.0 and 5.0.0-5.3.3, allowing authenticated users to bypass permission checks when creating pages, files, or users. This issue arises from the ability to inject custom dynamic blueprint options that override the default permissions set by the site developer. The vulnerability can be exploited by users whose roles do not have the 'create' permission for pages, files, or users, effectively allowing unauthorized actions and privilege escalation.

Impact

Exploitation of this vulnerability could lead to unauthorized creation of pages, files, or users, bypassing the intended permission controls and causing a privilege escalation.

Remediation

Users can upgrade to Kirby 4.9.0 or 5.4.0, both of which include the necessary patch. Instructions for downloading these versions are available on the Kirby GitHub releases page.