Kirby CMS Information Disclosure via Field Permission Bypass (GHSA-8r9g-hhm3-5jfh)

Vulnerability Overview Vulnerability Name: Access permissions are not checked when the , and fields resolve their stored value Vulnerability ID: GHSA-8r9g-hhm3-5jfh Severity: High (7.1 / 10) CVSS Score: 7.1 / 10 CVSS Vector: CVSS:3.0/AV:N/AC:L/AT:N/PR:L/UI:N/S:U/C:H/I:N/A:N CVE ID: No known CVE Weaknesses: - CWE-639 - CWE-862 Reporter: euricacio Description TL;DR This vulnerability affects all Kirby sites that rely on Blueprint permissions to hide certain pages, files, or users from specific roles, provided those roles may include authenticated Panel users. Exploitation requires a Panel user to have update permissions for any model containing , , or fields. Sites where every Panel user can view all content are unaffected. This vulnerability poses a high severity risk to affected sites. Affected Components The , , and fields resolve the IDs stored in content files back to their models when constructing the Panel view. In affected versions, the lookup did not check access and permissions, despite the browser checking these permissions via its picker. Two other Panel surfaces shared this gap: the location field in the dialog, and the breadcrumbs in the dialog listing sibling pages and files. Impact A Panel user can write any ID they have update permissions for within any page, file, or user field, and read the resolved model from standard Panel responses, regardless of permissions on that model. The field’s own restrictions are not enforced. For pages and users, this leaks titles, UUIDs, usernames, and email addresses, even if the role has no access to them. For files, it also leaks media URLs containing tokens required to authorize access to the file. This does not change the attacker's own permissions, nor does it allow writing content to models that they cannot update. Patch The issue was fixed in and . In these versions, the , , and fields check each resolved model against the same predicate. Models that the current user cannot list are replaced with placeholders containing only the ID already stored in the content file, ensuring that saving the model does not lose entries. The location field and breadcrumbs remove inaccessible entries. Acknowledgements Thanks to Eurico Nicacio (@euricacio) for reporting the identified issue. Affected Versions Fixed Versions Attack Vector Metrics Attack Vector: Network Attack Complexity: Low Attack Requirements: None Privileges Required: Low User Interaction: None Vulnerable System Impact Metrics Confidentiality: High Integrity: None Availability: None Subsequent System Impact Metrics Confidentiality: None Integrity: None Availability: None

Goal Reached Thanks to every supporter — we hit 100%!

Kirby CMS Information Disclosure via Field Permission Bypass (GHSA-8r9g-hhm3-5jfh)

More from this source