Cross-Site Request Forgery Vulnerability in Thelia Back Office
CVE-2026-120206

5.9MEDIUM

Key Information:

Vendor

Thelia

Status
Thelia
Thelia Core
Thelia Back-office Default Twig Template
Thelia Back-office Default Template
Vendor
CVE Published:
31 October 2026

What is CVE-2026-120206?

Thelia versions prior to 3.2.0 contain a cross-site request forgery (CSRF) vulnerability that could enable an attacker to forge administrative actions in the back office. This occurs due to per-session CSRF tokens being leaked through URL query strings. Attackers can exploit this by reusing exposed tokens or targeting unprotected actions such as setToggleVisibilityAction and updatePositionAction, potentially allowing them to manipulate catalogue and configuration objects by deleting, hiding, or reordering them. Users should promptly upgrade to Thelia 3.2.0 or later to mitigate this security risk.

Affected Version(s)

Thelia 0 < 3.2.0

Thelia Back-office Default Template 0 <= 2.6.2

Thelia Back-office Default Twig Template 0 < 1.2.0

References

https://github.com/thelia/thelia/security/advisories/GHSA...
vendor-advisory
https://github.com/thelia/thelia/commit/55a7156e552d0b814...
patch
https://github.com/thelia-templates/default-twig/commit/a...
patch

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pnn219
.