Kirby CMS versions before 4.9.0 and between 5.0.0 and 5.4.0 have a vulnerability where the 'pages.changeStatus' permission does not apply when creating pages via the REST API. Normally, new pages are created as drafts and require a separate status change to publish, controlled by user permissions. However, the REST API allowed overriding the draft status flag, enabling users with only 'pages.create' permission to create published pages immediately, bypassing editorial controls. The vulnerability stems from independent permission checks and improper handling of blueprint option queries. The issue was fixed by Kirby in versions 4.9.0 and 5.4.0 by correcting the permission enforcement and blueprint query resolution logic.

Authenticated users with the 'pages.create' permission can bypass the editorial workflow and publish new pages directly via the REST API, potentially leading to unauthorized content publication. This undermines the intended content moderation and approval process within the CMS. There are no known exploits in the wild as of the publication date.

This vulnerability is patched in Kirby versions 4.9.0 and 5.4.0. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, remediation requires applying the official software update. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigation steps are indicated.