AIKIDO-2026-509014

TL;DR

Statamic's ip_address content protection scheme matches its allow-list against the whole forwarded address chain from request()->ips() instead of the resolved client address. An unauthenticated visitor can place an allowed address anywhere in that chain through a crafted forwarding header, so protected content is served to a client whose real address was never on the list. Only sites that enable this non-default scheme behind configured trusted proxies are affected. The fix compares the allow-list against request()->ip(), so deployments behind a load balancer must list the balancer among their trusted proxies.