Kirby CMS versions before 4.9.0 and between 5.0.0 and 5.4.0 have a vulnerability where the permissions controlling page creation and status changes are checked independently. While the CMS panel enforces that new pages are created as drafts requiring publishing, the REST API allows overriding the isDraft flag during page creation. This allows authenticated users with the pages.create permission to create pages that are immediately published, circumventing the editorial workflow. The vulnerability is due to improper neutralization of special elements in the template engine and flawed permission enforcement logic. The issue was patched by Kirby in versions 4.9.0 and 5.4.0 by correcting the options logic to avoid double-resolving queries and ensuring proper permission checks.

An authenticated user with the pages.create permission can bypass the intended editorial workflow by creating published pages directly through the REST API, potentially leading to unauthorized content publication. This could affect content integrity and editorial controls within affected Kirby CMS installations. There are no known exploits in the wild as of the published date.

This vulnerability has been patched in Kirby CMS versions 4.9.0 and 5.4.0. Users should upgrade to these or later versions to remediate the issue. Since this is not a cloud service, patching the affected software versions is required. Patch status is confirmed by the vendor advisory embedded in the description. No additional mitigations are indicated.