Cross-Site Request Forgery in Thelia Back-office Default Twig Template
CVE-2026-120249
6.9MEDIUM
Key Information:
- Vendor
Thelia
- Vendor
- CVE Published:
- 1 November 2026
What is CVE-2026-120249?
The Thelia Back-office Default Twig Template prior to version 1.1.1 is susceptible to a Cross-Site Request Forgery vulnerability. This issue arises from the absence of anti-CSRF token checks on the /admin/product/combinations/update and /admin/product/default-price/update routes, which permit GET requests. An attacker could potentially exploit this vulnerability by tricking an authenticated administrator into clicking a crafted link, enabling them to alter critical product attributes such as prices, stock levels, weight, EAN codes, and sale flags, thereby manipulating the product data without the user's consent.
Affected Version(s)
Thelia Back-office Default Twig Template 0 < 1.1.1