Kirby is an open‑source content management system. Versions released before 4.9.4 and any 5.x release before 5.4.4 allow sites with no configured user accounts and running on publicly accessible servers behind a reverse proxy that forwards the Forwarded, X‑Client‑IP, or X‑Real‑IP request header to be compromised. Because local‑IP checks incorrectly trust those headers, a remote attacker can inject them into a request and trigger the automatic installation of the Panel, creating the first administrative user. This results in full administrative control over the site. The flaw is classified as CWE‑454.

The vulnerability affects getkirby:kirby installations running any version before 4.9.4 and any 5.x release before 5.4.4 that have no configured user accounts. Only sites exposed to the public internet behind a reverse proxy that forwards the Forwarded, X‑Client‑IP, or X‑Real‑IP headers are susceptible.

The CVSS score of 9.1 indicates a severe flaw. The EPSS score of less than 1% implies a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a crafted HTTP request to the reverse proxy containing the aforementioned headers, which an attacker controlling or accessing the proxy can easily perform. If unpatched, an attacker can gain full administrative access to the site.