CVE-2026-54003

{
  "id": "CVE-2026-54003",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-09T19:17:06.120",
  "lastModified": "2026-10-25T17:10:00.197",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4."
    },
    {
      "lang": "es",
      "value": "Kirby es un sistema de gestión de contenido de código abierto. Antes de la versión 4.9.4 y desde la 5.4.4, los sitios de Kirby sin cuentas de usuario configuradas que se ejecutan en servidores de acceso público detrás de un proxy inverso que establece el encabezado de solicitud Forwarded, X-Client-IP o X-Real-IP podrían permitir a atacantes remotos instalar el Panel y crear el primer usuario administrador porque las comprobaciones de IP local confiaban incorrectamente en esos encabezados. Este problema está solucionado en las versiones 4.9.4 y 5.4.4."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "getkirby",
          "product": "kirby",
          "versions": [
            {
              "version": "< 4.9.4",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.4.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-09T19:23:16.615569Z",
          "id": "CVE-2026-54003",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-454"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/pull/8166",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/releases/tag/4.9.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/releases/tag/5.4.4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv",
      "source": "[email protected]"
    }
  ]
}