CVE-2026-54003

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4

Description An external initialization issue exists in the Kirby Panel and REST API. This occurs when a site has no configured user accounts and is hosted on a publicly accessible server behind a reverse proxy. The isLocal check, used to ensure that the initial admin user can only be created from a local IP address, fails to properly validate the Forwarded: for=..., X-Client-IP, or X-Real-IP request headers. This allows remote attackers to bypass the local IP restriction and create the first admin user account, gaining full control over the system. External initialization is a flaw that allows attackers to initialize a system or configuration value without authentication.

Recommendations Update to version 4.9.4 or later. Update to version 5.4.4 or later. As a temporary workaround, create an initial admin account to deactivate the vulnerable installation code. As a temporary workaround, disable the REST API by setting the 'api' => false option in config.php if the Panel is not required.