CVE-2026-84186

The record

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.

Affected packages

Related vulnerabilities

• CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its… CWE-290
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-290
• CVE-2026-66674 Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions. CWE-290
• CVE-2026-82563 An attacker could impersonate the camera and place themselves in a man-in-the-middle or… CWE-290
• CVE-2026-82530 IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control… CWE-290
• CVE-2026-77089 Command Center API contained an authentication bypass issue affecting privilege… CWE-290
• CVE-2026-86478 In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in… CWE-290
• CVE-2026-86196 Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host… CWE-290