Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.

Affected: Packagist: getkirby/cms

### TL;DR

This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the `Forwarded: for=...`, `X-Client-IP`, or `X-Real-IP` request header.

It was possible to install the Panel (= create the first admin user) in these setups even from remote IP addresses.

**This vulnerability is of critical severity for affected sites.**

Your site is *not* affected if any of the following apply:

- An admin account has already been configured - The Panel and API are disabled - The site is not running behind a reverse proxy - The reverse proxy sets the `X-Forwarded-For` or `Client-IP` header instead of the affected ones.

----

### Introduction

External Initialization is a type of vulnerability that allows attackers to initialize a system or configuration value without authentication.

This can give untrusted actors access to the system or let them control its behavior.

### Affected components

The Kirby Panel and REST API are authenticated by local user accounts. If a Kirby installation does not yet have any users, it first needs to be installed. During the installation process, an initial admin user account is created.

To protect against external initialization attacks that would allow untrusted actors to create an admin user for the Kirby installation, Kirby already checked whether the current request came from a local IP address. This allows installing the Panel in local development…