---
id: CVE-2026-120206
title: Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
summary: >-
  Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the
  back office that allows attackers to forge administrative actions because
  per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked
  token…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-352
vendor: Thelia
product: Thelia
affected:
  - Thelia < 3.2.0
  - core < 3.2.0
  - back-office_default_twig_template < 1.2.0
  - back-office_default_template <= 2.6.2
  - smarty_module <= 3.0.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T15:32:52.686010Z'
exploitAvailable: true
published: '2026-10-31'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:33:23.336Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120206'
references:
  - url: 'https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp'
    label: GitHub Security Advisory (GHSA-cfvv-2jvw-x2hp)
  - url: >-
      https://github.com/thelia/thelia/commit/55a7156e552d0b8145309b10175d13ecc1187433
  - url: >-
      https://github.com/thelia-templates/default-twig/commit/a9647682572de056ba258a2d4d53e42f5b591b84
  - url: 'https://github.com/thelia/thelia/releases/tag/3.2.0'
    label: Thelia 3.2.0 Release Notes
  - url: >-
      https://github.com/thelia/thelia/blob/3.1.6/core/lib/Thelia/Controller/Admin/AbstractCrudController.php#L466
  - url: >-
      https://www.vulncheck.com/advisories/thelia-before-3.2.0-back-office-csrf-via-url-token-and-unprotected-actions
    label: >-
      VulnCheck Advisory: Thelia before 3.2.0 Back-Office CSRF via URL Token and
      Unprotected Actions
tags:
  - cve.org
  - exploit-available
epss: 0.0015
epssPercentile: 0.04207
ingestedAt: '2026-11-05T21:36:00.906Z'
---

## Overview

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

## Affected

- `Thelia < 3.2.0`
- `core < 3.2.0`
- `back-office_default_twig_template < 1.2.0`
- `back-office_default_template <= 2.6.2`
- `smarty_module <= 3.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.