CVE-2026-54003: Kirby CMS Critical Vulnerability in External Initialization of the Panel
Summary
CVE-2026-54003: Kirby: External Initialization of the Panel on reverse proxy setups with the Forwarded header. Affects getkirby/cms across 2 version ranges.
< 4.9.4
>= 5.0.0-alpha.1, < 5.4.4
Fixed in 4.9.4 or 5.4.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Kirby is a flexible and powerful content management system (CMS) that allows users to create and manage websites with ease. It is known for its simplicity, user-friendly interface, and the ability to customize content structures. However, this vulnerability exposes Kirby installations without user accounts to unauthorized access, particularly when hosted behind certain reverse proxies.
Vulnerability Detail
The vulnerability arises from an improper check in the installation logic of the Kirby CMS, specifically in how it interprets the 'Forwarded', 'X-Client-IP', and 'X-Real-IP' headers. This flaw allows attackers to create an admin user account remotely on installations that lack configured user accounts, posing a significant security risk. The issue is particularly critical for publicly accessible servers behind reverse proxies that utilize these headers, leading to potential unauthorized access and control over the CMS.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.9.44.9.4composer require getkirby/cms:4.9.4 -
>= 5.0.0-alpha.1, < 5.4.45.4.4composer require getkirby/cms:5.4.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to update immediately, consider the following workarounds: 1. Manually create an initial admin account to bypass the vulnerable installation code. 2. Disable the REST API by adding the following line to your config.php file: 'api' => false.
Conclusion
The CVE-2026-54003 vulnerability in Kirby CMS poses a critical risk for installations without user accounts, particularly when behind certain reverse proxies. Immediate action is required to update to the patched versions or implement workarounds to secure your site.
See every vulnerability recorded for getkirby/cms →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions are Kirby CMS versions 4.9.3 and earlier, as well as 5.4.3 and earlier.
You can either create an initial admin account manually or disable the REST API as a temporary measure.
The vulnerability involves the 'Forwarded', 'X-Client-IP', and 'X-Real-IP' headers, which are misinterpreted by the installation logic.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
