Open Redirect Vulnerability in Thelia eCommerce Platform

CVE-2026-103523

What is CVE-2026-103523?

Thelia v2.6.0 is susceptible to an open redirect vulnerability within its address creation workflow. This flaw allows attackers to manipulate the application to redirect users to arbitrary external URLs if they submit a specifically crafted URL via the 'Add New Address' form. The application fails to verify if the destination URL aligns with the same origin or any approved allowlist, thus potentially leading users to malicious websites controlled by the attacker.

References