The vulnerability in CodeIgniter's IncomingRequest::isSecure() method arises because it trusts the X-Forwarded-Proto and Front-End-Https headers from any incoming request without validation. An attacker can spoof these headers to make the application treat an HTTP request as if it were HTTPS. This affects security-sensitive decisions and HTTPS enforcement mechanisms such as isSecure(), force_https(), and forceGlobalSecureRequests. The risk is higher if the backend server is accessible over HTTP or if reverse proxies/load balancers forward client-supplied headers without stripping or overwriting them. The issue is addressed by upgrading to CodeIgniter version 4.7.4 or later.

An attacker can spoof forwarded HTTPS headers to bypass HTTPS enforcement in affected CodeIgniter applications, potentially causing the application to treat insecure HTTP requests as secure. This could lead to security-sensitive logic being bypassed, impacting confidentiality and integrity of data handled by the application. The impact is limited to deployments where the backend is directly reachable over HTTP or where reverse proxies do not sanitize forwarding headers. There is no indication of availability impact or known exploits in the wild.

Upgrade CodeIgniter to version 4.7.4 or later to apply the official fix. If immediate upgrade is not possible, enforce HTTP-to-HTTPS redirects outside the application using web server or load balancer configurations (e.g., Apache .htaccess, nginx server blocks, Caddy config). Additionally, ensure reverse proxies or load balancers strip or overwrite client-supplied X-Forwarded-Proto and Front-End-Https headers before forwarding requests to the backend application.