CVE-2026-84186
Received Received - Intake

IP Spoofing via X-Forwarded-For in PrestaShop

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-84186
EUVD
EUVD-2026-72305

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
prestashop prestashop to 8.2.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect access control in PrestaShop's Tools::getRemoteAddr() function. When PrestaShop runs behind a reverse proxy, load balancer, or CDN, it incorrectly processes the client's IP address from the X-Forwarded-For header. Instead of using the trusted infrastructure's IP, it uses the visitor-controlled address. This allows unauthenticated attackers to spoof their IP address, bypassing IP-based security controls like maintenance mode allowlists.

Detection Guidance

To detect this vulnerability, inspect HTTP request headers for the X-Forwarded-For header in PrestaShop logs or network traffic. Check if the application processes this header and logs or uses the spoofed IP address. Verify if IP-based controls like maintenance mode allowlists are bypassed by testing with different X-Forwarded-For values.

Impact Analysis

This vulnerability allows attackers to bypass IP-based restrictions, forge security logs, and evade detection systems that rely on IP addresses. For example, an attacker could bypass maintenance mode restrictions, manipulate audit logs to hide malicious activity, or evade fraud detection and geolocation checks. It affects any PrestaShop installation running behind a reverse proxy, load balancer, or CDN.

Compliance Impact

This vulnerability could impact compliance by allowing attackers to forge logs and bypass IP-based controls. For GDPR, this may affect audit trails and data integrity. For HIPAA, it could compromise access controls and logging mechanisms. Organizations must ensure proper IP validation and logging to maintain compliance.

Mitigation Strategies

Update PrestaShop to version 9.1.5 or 8.2.8 or later to address the vulnerability in the Tools::getRemoteAddr() function.

If immediate updating is not possible, review and restrict access to IP-based controls like maintenance mode allowlists and third-party IP-dependent mechanisms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84186. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart