CVE-2020-10793

CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.

• CWE-269

• https://codeigniter4.github.io/userguide/extending/authentication.htmlVendor Advisory
• https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeigniter-framework-ca30741ad297
• https://codeigniter4.github.io/userguide/extending/authentication.htmlVendor Advisory
• https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeigniter-framework-ca30741ad297

Published

Mar 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10788openITCOCKPIT before 3.7.3 uses the 1fea123e07f730f76e661bce…9.1
• CVE-2020-10789openITCOCKPIT before 3.7.3 has a web-based terminal that all…9.8
• CVE-2020-1079An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-10790openITCOCKPIT before 3.7.3 has unnecessary files (such as Lo…5.4
• CVE-2020-10791app/Plugin/GrafanaModule/Controller/GrafanaConfigurationCont…6.5
• CVE-2020-10792openITCOCKPIT through 3.7.2 allows remote attackers to confi…7.5
• CVE-2020-10794Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to unauthenticated…9.8
• CVE-2020-10795Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated r…7.2
• CVE-2020-10797An XSS vulnerability resides in the hostname field of the di…6.1
• CVE-2020-10799The svglib package through 0.9.3 for Python allows XXE attac…9.8
• CVE-2020-1080<p>An elevation of privilege vulnerability exists when Windo…8.8
• CVE-2020-10800lix through 15.8.7 allows man-in-the-middle attackers to exe…8.1