CVE-2026-54003 is a critical vulnerability in the Kirby content management system involving external initialization of trusted variables or data stores (CWE-454). Specifically, Kirby sites without configured user accounts running behind reverse proxies that set the Forwarded, X-Client-IP, or X-Real-IP headers incorrectly trust these headers for local-IP checks. This flaw allows remote attackers to install the administrative Panel and create the first admin user account remotely. The vulnerability affects versions prior to 4.9.4 and versions from 5.0.0 up to but not including 5.4.4. The issue has been fixed in versions 4.9.4 and 5.4.4.

An attacker can remotely gain administrative access by installing the Panel and creating the first admin user on vulnerable Kirby sites that have no user accounts configured and are behind reverse proxies setting specific headers. This compromises the integrity and control of the affected system, allowing full administrative control without prior authentication.

Upgrade Kirby to version 4.9.4 or later in the 4.x series, or to version 5.4.4 or later in the 5.x series. These versions contain fixes that correctly validate the Forwarded, X-Client-IP, and X-Real-IP headers to prevent unauthorized administrative access. Until upgraded, restrict access to the site or reverse proxy to trusted networks to reduce exposure.