Incorrect Access Control in PrestaShop Allows IP Spoofing

CVE-2026-84186

What is CVE-2026-84186?

The vulnerability in PrestaShop's Tools::getRemoteAddr() function arises from improper handling of client IP addresses when the application operates behind a reverse proxy, load balancer, or CDN. This flaw permits an attacker to spoof their IP address using the X-Forwarded-For header, causing the application to mistakenly trust the visitor-controlled address instead of the valid IP supplied by the trusted infrastructure. As a result, this can enable unauthorized circumvention of IP-based restrictions, like maintenance mode allowlists, and lead to potential forgery of security and audit logs. Furthermore, this vulnerability undermines third-party systems reliant on IP addresses for critical functionalities such as geolocation, fraud detection, and request throttling.

References