Kirby CMS CVE-2026-41325: Brief Summary of a Blueprint Injection Authorization Bypass

Introduction

An authenticated user in Kirby CMS can bypass content creation restrictions by injecting a crafted blueprint parameter into API requests, which overrides the permissions that site administrators configured for their roles. For organizations that rely on Kirby's role-based access controls to enforce least privilege across editorial teams, this vulnerability undermines the entire authorization model for content and user creation.

Kirby is an open-source, file-based content management system maintained by Content Folder GmbH & Co. KG. It has been commercially self-funded and profitable for over a decade, with a niche but loyal user base of developers and agencies who prefer its flat-file architecture to database-driven CMS platforms. The vulnerability surfaces in Kirby's Panel (its administrative interface), so it matters for any deployment that exposes the Panel to multiple user roles with different permission levels.

Technical Information

Kirby controls user authorization through a layered blueprint system. Permissions are defined at two levels: in user blueprints (located at site/blueprints/users/...), which govern what each role can do, and in model blueprints (such as site/blueprints/pages/...), which use an options feature to customize permissions for specific target models. Together, these two layers determine whether a given user is authorized to perform actions like pages.create, files.create, or users.create.

Root Cause

The root cause of CVE-2026-41325 is an improper authorization check (CWE-863) in the normalization code that processes creation requests for pages, files, and users. In vulnerable versions, the application does not filter the blueprint property from incoming request data. An authenticated attacker can therefore add a crafted blueprint parameter to a creation API call. The parameter carries dynamic blueprint configuration that sets the create option to true.

When the application processes this request, it merges the injected blueprint configuration into the model data. The injected options then take precedence over the permissions and options that the site developer configured in the user and model blueprints. A user whose role should be denied the ability to create pages, files, or users can bypass that restriction entirely.

Attack Flow

1. An attacker authenticates to the Kirby Panel with a low-privilege account whose role is explicitly restricted from creating certain content types (pages, files, or users).
2. The attacker crafts a creation request to the relevant API endpoint (for pages, files, or users) and injects a blueprint property into the request payload.
3. The injected blueprint contains dynamic configuration that sets the create option to true.
4. The server-side normalization code processes the request without filtering the blueprint property, so the injected configuration overrides the developer-defined restrictions.
5. The creation action succeeds even though the user's role is configured to deny it.

CVSS Scoring

The CVSS v4 score accurately reflects the high integrity impact of the flaw, while the v3 scoring system rates it as Medium. The impact is limited to integrity. There is no direct risk to confidentiality or availability.

Configuration Dependency

Sites are vulnerable only if they intentionally restrict certain user roles from creating content or users. If a site allows all authenticated users to create pages, files, and users, this vulnerability does not affect it.

Affected Systems and Versions

Organizations on the v4 branch can apply the backported fix without a major-version upgrade, while those on v5 should move directly to 5.4.0. The vulnerability affects deployments where the Kirby Panel is accessible and role-based permissions restrict content or user creation for certain roles.

Vendor Security History

Kirby's security process is mature, with a publicly documented security policy and a clear history of coordinated disclosures. Kirby provides long-term support: the v5 branch receives security updates until June 2028, and the v4 branch is supported until November 2026. Kirby encourages responsible disclosure through a dedicated security email address, provides a GPG key for encrypted communications, and actively backports security fixes to older major versions.

The 5.4.0 release that patches CVE-2026-41325 also fixes several other significant security flaws. The advisories in that release include:

This many fixes in a single release suggests that Kirby conducted a broader security review or responded to findings from multiple researchers in a coordinated disclosure cycle.

References

• CVE-2026-41325 on NVD
• CVE-2026-41325 on Tenable
• GitHub Advisory GHSA-6gqr-mx34-wh8r
• Kirby 4.9.0 Release Notes
• Kirby 5.4.0 Release Notes
• Kirby Security Policy