CVE-2026-44174General

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password() (disclosing the password hash) or root() (disclosing the absolute filesystem path on the server) as well as methods that perform impactful actions such as loginPasswordless() (causing a privilege escalation to another user) or delete() (deleting all queried models in one go if the authenticated user has appropriate permissions). This issue has been fixed in versions 4.9.1 and 5.4.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-470

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-16); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

General

266.7%

Disclosure

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Disclosure1General1
2026-07-17	1	General1

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-44174 Arbitrary Model Method Injection in Kirby CMS Before 4.9.1 and 5.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44174 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
Tweet references CVE-2026-44174 and links to a Vulmon details page, but provides no PoC, exploit, patch info, active exploitation claim, technical details, or false positive indication.
0000093
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-44174 Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, all… https://www.cve.org/CVERecord?id=CVE-2026-44174 ----- Traducción: CVE-2026-44174 Kir… http://infoflow.cloud`
Post summary
The post announces CVE-2026-44174, noting that Kirby CMS failed to validate model attributes in collection queries before versions 4.9.1 and 5.4.1, but it offers no further technical, exploit, or mitigation details.
0000033
92 followersView on X
CVE@CVEnew91d
General
CVE-2026-44174 Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, all… https://www.cve.org/CVERecord?id=CVE-2026-44174
Post summary
The post references CVE-2026-44174 and notes a model attribute validation issue in Kirby before specific versions, but provides no PoC, exploit, patch, or active exploitation details.
00000657
57.8K followersView on X

Explore more

Back to dashboard