The vulnerability in Kirby CMS (CVE-2026-44174) is an unsafe reflection issue (CWE-470) where externally-controlled input is used to select classes or code without proper validation. Specifically, prior to versions 4.9.1 and 5.4.1, Kirby did not validate model attributes in collection queries, enabling attackers to call arbitrary model methods. These methods include sensitive data accessors like password() and root(), as well as methods that can escalate privileges (loginPasswordless()) or delete data (delete()) if the user has permissions. This can lead to disclosure of sensitive information and unauthorized actions. The vulnerability has been addressed in Kirby versions 4.9.1 and 5.4.1.

Exploitation allows attackers with limited privileges to execute arbitrary model methods in queries, potentially disclosing sensitive information such as password hashes and filesystem paths. It also enables privilege escalation to other users and deletion of queried models if the attacker has appropriate permissions. This can result in data exposure, unauthorized access, and data loss.

This vulnerability is fixed in Kirby versions 4.9.1 and 5.4.1. Users should upgrade to these versions or later to remediate the issue. No additional vendor advisory or patch information is provided, so patch status beyond these versions is not confirmed. Patch status is considered fixed in these versions.