CVE-2026-120206Medium· 5.9▾ TwilightPoC availableThelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked token…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 32.5 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
Thelia < 3.2.0core < 3.2.0back-office_default_twig_template < 1.2.0back-office_default_template <= 2.6.2smarty_module <= 3.0.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120249Medium· 6.5Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes
CVE-2026-120205High· 8.0Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE-2026-109396Medium· 4.2Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields
CVE-2026-120248Medium· 4.8Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
CVE-2026-120207High· 7.1Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
CVE-2026-112285Medium· 4.3Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders