PrestaShop IP Spoof via getRemoteAddr X-Forwarded-For
CVE-2026-84186 Published on September 7, 2026
Incorrect access control in PrestaShop
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the clients IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.
Vulnerability Analysis
CVE-2026-84186 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
Products Associated with CVE-2026-84186
Want to know whenever a new CVE is published for PrestaShop? stack.watch will email you.
Affected Versions
PrestaShop:- Before 9.1.5 is affected.
- Before 8.2.8 is affected.