CVE-2020-10793

Vulnerability

Claim

CVE-2020-10793 alleges that CodeIgniter versions through 4.0.0 allow remote attackers to gain privileges by modifying an Email ID on the "Select Role of the User" page [1]. The claim suggests that an attacker could escalate privileges by tampering with an email parameter during user role selection.

Dispute and

Counterarguments

Several contributors dispute this attribution. They argue that CodeIgniter, as a framework, does not provide a login screen or any user management facilities beyond a Session library [1]. The framework's official repository and documentation confirm that authentication and user management are not built-in; they must be implemented separately or via third-party modules like CodeIgniter Shield [2][3]. The referenced blog post points to an unknown website built with CodeIgniter, but the vulnerability resides in a custom module or plugin, not in the framework core [1].

Impact and

Mitigation

If the vulnerability exists, it could allow an attacker to gain elevated privileges within a specific application. However, since the issue is not in CodeIgniter itself, no framework-level patch is needed. Developers are advised to review their authentication and user role handling custom code [1]. The framework continues to be actively maintained, and the community recommends using the official authentication library (Shield) to avoid such custom implementation errors [3].