CVE-2026-63220 Details
Description
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may have impacted applications that rely on isSecure(), force_https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-only access or make security-sensitive decisions. Exploitability depends on deployment configuration. Applications are most exposed if the backend is reachable directly over HTTP, or if a reverse proxy/load balancer forwards client-supplied forwarding headers without stripping or overwriting them. This issue has been fixed in version 4.7.4.
A vulnerability exists in CodeIgniter versions prior to 4.7.4, where the IncomingRequest::isSecure() method improperly trusted the X-Forwarded-Proto and Front-End-Https headers from all incoming requests. This flaw allowed attackers to spoof these headers, misleading the application into believing an HTTP request was secure. Such misrepresentation could affect applications that use isSecure(), force_https(), forceGlobalSecureRequests, or similar functions to enforce HTTPS access or make critical security decisions. The vulnerability's exploitability hinges on the deployment setup, with heightened risk for applications directly accessible over HTTP or those behind a reverse proxy or load balancer that forwards unmodified client-supplied headers.
Upgrade to CodeIgniter version 4.7.4 or later. For users unable to upgrade immediately, it's recommended to enforce HTTP-to-HTTPS redirects using server-level configurations or load balancer rules. Additionally, ensure that any reverse proxies strip or overwrite client-supplied forwarding headers before they reach the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/codeigniter4/CodeIgniter4/commit/ecbf044666bed41d23f07518096d9843fe6c08b0 | [email protected] | Source CodeVendor |
| https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4 | [email protected] | Release NotesVendor |
| https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7wmf-pw8j-mc78 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CodeIgniter | < 4.7.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |