CVE-2022-24712

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the request method in the controller method before processing.

• CWE-352

• https://github.com/codeigniter4/CodeIgniter4/blob/7dc2ece32401ebde67122f7d2460efcaee7c352e/user_guide_src/source/changelogs/v4.1.9.rstRelease Notes, Third Party Advisory
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4v37-24gm-h554Mitigation, Third Party Advisory
• https://github.com/codeigniter4/CodeIgniter4/blob/7dc2ece32401ebde67122f7d2460efcaee7c352e/user_guide_src/source/changelogs/v4.1.9.rstRelease Notes, Third Party Advisory
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4v37-24gm-h554Mitigation, Third Party Advisory

Published

Feb 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24707Anuko Time Tracker is an open source, web-based time trackin…8.8
• CVE-2022-24708Anuko Time Tracker is an open source, web-based time trackin…5.4
• CVE-2022-24709@awsui/components-react is the main AWS UI package which con…6.1
• CVE-2022-2471Stack-based Buffer Overflow vulnerability in the EZVIZ Motio…9.8
• CVE-2022-24710Weblate is a copyleft software web-based continuous localiza…5.4
• CVE-2022-24711CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-st…9.8
• CVE-2022-24713regex is an implementation of regular expressions for the Ru…7.5
• CVE-2022-24714Icinga Web 2 is an open source monitoring web interface, fra…5.3
• CVE-2022-24715Icinga Web 2 is an open source monitoring web interface, fra…8.8
• CVE-2022-24716Icinga Web 2 is an open source monitoring web interface, fra…7.5
• CVE-2022-24717ssr-pages is an HTML page builder for the purpose of server-…6.1
• CVE-2022-24718ssr-pages is an HTML page builder for the purpose of server-…6.5