CVE-2026-54003

Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d
https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234
https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b
https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a
https://github.com/getkirby/kirby/pull/8166
https://github.com/getkirby/kirby/releases/tag/4.9.4
https://github.com/getkirby/kirby/releases/tag/5.4.4
https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Kirby es un sistema de gestión de contenido de código abierto. Antes de la versión 4.9.4 y desde la 5.4.4, los sitios de Kirby sin cuentas de usuario configuradas que se ejecutan en servidores de acceso público detrás de un proxy inverso que establece el encabezado de solicitud Forwarded, X-Client-IP o X-Real-IP podrían permitir a atacantes remotos instalar el Panel y crear el primer usuario administrador porque las comprobaciones de IP local confiaban incorrectamente en esos encabezados. Este problema está solucionado en las versiones 4.9.4 y 5.4.4.

Information

Published : 2026-07-09 19:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-54003

Mitre link : CVE-2026-54003

CVE.ORG link : CVE-2026-54003

JSON object : View

Products Affected

No product.

CWE

CWE-454

External Initialization of Trusted Variables or Data Stores

{"id": "CVE-2026-54003", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54003", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T19:23:16.615569Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}]}], "published": "2026-07-09T19:17:06.120", "references": [{"url": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/pull/8166", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-454"}]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de la versi\u00f3n 4.9.4 y desde la 5.4.4, los sitios de Kirby sin cuentas de usuario configuradas que se ejecutan en servidores de acceso p\u00fablico detr\u00e1s de un proxy inverso que establece el encabezado de solicitud Forwarded, X-Client-IP o X-Real-IP podr\u00edan permitir a atacantes remotos instalar el Panel y crear el primer usuario administrador porque las comprobaciones de IP local confiaban incorrectamente en esos encabezados. Este problema est\u00e1 solucionado en las versiones 4.9.4 y 5.4.4."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}