Cross-Site Request Forgery in Thelia Page Module by Thelia

CVE-2026-120207

What is CVE-2026-120207?

The Thelia Page Module prior to version 2.0.4 is susceptible to a cross-site request forgery vulnerability that permits unauthorized removal of page tags, documents, and images. This issue arises from the absence of CSRF tokens and permission verification in the back-office deletion routes. Malicious actors can exploit this flaw by tricking an authenticated administrator into visiting specially crafted GET requests designed to sequentially delete TheliaLibrary images and their associated files across various pages, products, and categories.

References