CVE-2026-84186— Incorrect access control in PrestaShop
Quick assessment
Affected
PrestaShop PrestaShop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
该漏洞涉及 PrestaShop 中 函数的访问控制缺陷。当应用部署在反向代理、负载均衡器或 CDN 之后时，攻击者可以通过伪造 请求头来欺骗客户端 IP 地址。应用程序错误地处理了 IP 地址字符串，使用了由访问者（而非可信基础设施）提供的地址，使得未认证的远程攻击者可以诱使应用程序将其连接解释为来自任意 IP 地址。 这种状况可能导致基于 IP 的控制机制（例如维护模式的白名单）被绕过，同时也会造成安全日志和审计日志的伪造，并使依赖 IP 地址的第三方机制失效，例如地理位置检查、欺诈检测或请求速率限制等。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84186
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect access control in PrestaShop
Source: CVE Program / CVE List V5
Vulnerability Description
Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用欺骗进行的认证绕过
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| PrestaShop | PrestaShop | 0 ~ 9.1.5 | - |
|
II. Public POCs for CVE-2026-84186
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84186
请登录查看更多情报信息。
Other References for CVE-2026-84186 (1)
IV. Related Vulnerabilities
Same product: PrestaShop
-
CVE-2026-44212
PrestaShop: Stored XSS executable in customer service view -
CVE-2026-33674
PrestaShop: Improper Use of Validation Framework -
CVE-2026-33673
PrestaShop has multiple stored XSS vulnerabilities via unpro -
CVE-2026-25597
PrestaShop has a time based enumeration in FO login form -
CVE-2025-1230
Cross-Site Scripting (XSS) vulnerability in Prestashop
Same vendor: PrestaShop
-
CVE-2026-54159
ps_facetedsearch: PHP Object Injection in faceted search cac -
CVE-2026-14846
Incorrect neutralisation in the PrestaShop firmware -
CVE-2026-44212
PrestaShop: Stored XSS executable in customer service view -
CVE-2026-33674
PrestaShop: Improper Use of Validation Framework -
CVE-2026-33673
PrestaShop has multiple stored XSS vulnerabilities via unpro
Same weakness: CWE-290
-
CVE-2026-86196
Grav API Plugin before 1.0.20 Authentication Bypass via Host -
CVE-2026-85432
MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing -
CVE-2026-84766
WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnera -
CVE-2026-84849
WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass -
CVE-2026-19117
Delinea Secret Server FIDO2 credential registration authenti
V. Comments for CVE-2026-84186
No comments yet