CVE-2020-26253: 
PHP vulnerability analysis and mitigation

Kirby CMS versions before 3.3.6 and Kirby Panel before version 2.5.14 contained a vulnerability that allowed unauthorized access to the admin panel when hosted on a .dev domain. The vulnerability was discovered in December 2020 and affected the security feature that blocks account registration on public servers by default (GitHub Advisory, NVD).

The vulnerability stemmed from an implementation flaw where the installation block still assumed .dev domains were local domains, which is no longer true as these domains became publicly available. Additionally, the local installation check could fail if the site was behind a reverse proxy. The vulnerability has been assigned CVE-2020-26253 with a CVSS v3.1 base score of 5.9 (Medium) and vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD).

The vulnerability could allow an attacker to register the first admin account on a public server if they discovered an uninitialized Kirby installation on a .dev domain or behind a reverse proxy. This would give them full administrative access to the CMS before the legitimate owner could set up their account (GitHub Advisory).

The vulnerability is only exploitable under specific conditions: the site must be using a .dev domain or be behind a reverse proxy, must not have any existing admin accounts registered, and an attacker must find the site and attempt to access the panel before the legitimate administrator creates the first account (GitHub Advisory).

The vulnerability was patched in Kirby 3.3.6 and Kirby Panel 2.5.14. Users are advised to upgrade to these or later versions to fix the vulnerability. For Kirby 2 sites that cannot be upgraded (noting that Kirby 2 reached end of life on December 31, 2020), updating to version 2.5.14 is still recommended (GitHub Advisory).