CVE-2026-41325

High

Published: 24 April 2026

Published

24 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0004 10.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41325 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Getkirby Kirby. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces configured user and model blueprint permissions during page, file, and user creation actions, preventing overrides via injected dynamic blueprint options.

SI-10 Information Input Validation good match

prevent

Validates and sanitizes inputs in creation requests to filter malicious blueprint properties, directly blocking the injection attack vector used to override permissions.

AC-6 Least Privilege partial match

prevent

Limits low-privileged users to only necessary permissions, reducing the impact and feasibility of overriding restrictions to perform unauthorized creations.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The incorrect authorization vulnerability (CWE-863) allows low-privileged authenticated users to bypass blueprint-defined permissions for create actions on pages, files, and users, directly enabling exploitation for privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is…

also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions. Kirby provides the `pages.create`, `files.create` and `users.create` permissions (among others). These permissions can again be set in the user blueprint and/or in the blueprint of the target model via `options`. Prior to versions 4.9.0 and 5.4.0, Kirby allowed to override the `options` during the creation of pages, files and users by injecting custom dynamic blueprint configuration into the model data. The injected `options` could include `'create' => true`, which then caused an override of the permissions and options configured by the site developer in the user and model blueprints. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. The patched versions have updated the normalization code that is used during the creation of pages, files and users to include a filter for the `blueprint` property. This prevents the injection of dynamic blueprint configuration into the creation request.

Deeper analysisAI

CVE-2026-41325 is an incorrect authorization vulnerability (CWE-863) affecting Kirby, an open-source content management system, in versions prior to 4.9.0 and 5.4.0. Kirby's user permissions, defined in user and model blueprints, control actions such as `pages.create`, `files.create`, and `users.create`. The flaw allows attackers to override these permissions by injecting custom dynamic blueprint configuration, including `options` like `'create' => true`, into model data during the creation of pages, files, or users. This bypasses developer-configured restrictions in `site/blueprints/users/...` and `site/blueprints/pages/...`.

The vulnerability has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by low-privileged authenticated users without user interaction. Such attackers can inject malicious `options` during creation requests, overriding permissions to perform unauthorized actions like creating pages, files, or users where explicitly denied, potentially leading to high impacts on confidentiality, integrity, and availability.

Kirby patched the issue in versions 4.9.0 and 5.4.0 by updating the normalization code used during page, file, and user creation to filter the `blueprint` property, preventing dynamic blueprint injection. Official advisories and release notes detail these changes and recommend upgrading immediately.