Listen to this Post
The vulnerability exploits a missing permission check in Kirby’s backend API for operations on the ‘changes version’ – a draft state for unsaved modifications to pages, users, files, or the site. Kirby’s role-based permissions allow administrators to disable the ‘update’ permission to prevent content modification. However, the API endpoints responsible for creating, editing, or discarding a changes version did not validate this ‘update’ permission. An authenticated attacker with Panel access could therefore interact with the changes version of any model, bypassing the intended write restrictions. This allows the creation of malicious draft changes, the locking of content to block editors, or the discarding of legitimate unsaved work.
Platform: Kirby CMS
Version: < 5.2.2
Vulnerability: Improper Access Control
Severity: Critical
date: 2025-05-29
Prediction: Patch released 2025-05-29
What Undercode Say:
Check current Kirby version composer show getkirby/cms | grep version Update Kirby to patched version composer require getkirby/cms:5.2.2
// Example of enforced permission check in patch
$model->permissions()->can('update');
How Exploit:
1. Attacker authenticates to Panel.
2. Targets model with restricted ‘update’ permission.
3. Sends API requests to `/api///change`.
4. Creates malicious draft or discards existing changes.
5. Locks content or plants disguised malicious edits.
Protection from this CVE:
Update to Kirby 5.2.2. Review user role permissions. Implement strict panel access controls.
Impact:
Content editing locks. Inadvertent malicious publish. Loss of editor work.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
