Read the docs
TI-2022-08527 Aliases CVE-2022-24712GHSA-4v37-24gm-h554

Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00565 47th percentileScored 2026-11-07
Fix Fixed CodeIgniter4 (codeigniter4): 4.1.9codeigniter4/framework (Packagist): 4.1.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codeigniter4CodeIgniter4before 4.1.94.1.9Patch availableCNA
—codeigniter4/framework (Packagist)before 4.1.94.1.9Patch availableGHSA-4v37-24gm-h554
  • CodeIgniter4 Vendorcodeigniter4 Affected before 4.1.9 Fixed in 4.1.9 Patch available CNA
  • codeigniter4/framework (Packagist) Vendor— Affected before 4.1.9 Fixed in 4.1.9 Patch available GHSA-4v37-24gm-h554

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*4.0.0 to before 4.1.9Vulnerablecodeigniter4
  • cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:* Versions 4.0.0 to before 4.1.9 Vulnerable ·codeigniter4

Remediation

  • Fix · CNA CodeIgniter4 (codeigniter4) Fixed in 4.1.9
  • Fix · GHSA-4v37-24gm-h554 codeigniter4/framework (Packagist) Fixed in 4.1.9 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24712
  2. 2026-10-03 Alias added: GHSA-4v37-24gm-h554

References

Advisory 3

  • TI-2014-07135 CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it… CVSS 3.0CRITICAL 9.8
  • TI-2022-16370 SameSite may allow cross-site request forgery (CSRF) protection to be bypassed CVSS 3.1HIGH 8.8
  • TI-2022-06025 Deserialization of Untrusted Data in Codeigniter4 CVSS 3.1CRITICAL 9.8
  • TI-2024-27591 A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily… CVSS 3.1HIGH 7.5
  • TI-2014-07136 CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by… CVSS 3.0CRITICAL 9.8
  • TI-2024-19671 CodeIgniter4 Language class DoS Vulnerability CVSS 3.1HIGH 7.5
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences