CVE-2026-120206 PUBLISHED

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Assigner: VulnCheck
Reserved: 31.10.2026 Published: 31.10.2026 Updated: 31.10.2026

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
CVSS Score: 5.9

Product Status

Vendor Thelia
Product Thelia
Versions Default: unaffected
  • affected from 0 to 3.2.0 (excl.)
Vendor Thelia
Product Thelia Core
Versions Default: unaffected
  • affected from 0 to 3.2.0 (excl.)
Vendor Thelia
Product Thelia Back-office Default Twig Template
Versions Default: unaffected
  • affected from 0 to 1.2.0 (excl.)
Vendor Thelia
Product Thelia Back-office Default Template
Versions Default: unaffected
  • affected from 0 to 2.6.2 (incl.)
Vendor Thelia
Product Thelia Smarty Module
Versions Default: unaffected
  • affected from 0 to 3.0.3 (incl.)

Credits

  • pnn219 finder

References

Problem Types

  • Cross-Site Request Forgery (CSRF) CWE