TI-2026-83556 Aliases CVE-2026-120206 GHSA-2qjc-j63h-9f97

Thelia back office CSRF via leaked URL tokens and unprotected actions

MEDIUM 60CWE-352Published 2026-10-31 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: Present
Impact type: Tampering
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Thelia before 3.2.0 has a cross-site request forgery flaw in its back office (CWE-352). Per-session CSRF tokens leak through URL query strings, and some administrative actions do not check tokens at all. A remote attacker can make a logged-in administrator delete, hide or reorder catalogue and configuration objects. The attack requires the administrator to take an action.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0015 4th percentileScored 2026-11-07

Fix Fixed Thelia (Thelia): 3.2.0Thelia Core (Thelia): 3.2.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Thelia	Thelia	before 3.2.0	3.2.0	Patch available	CNA
Thelia	Thelia Core	before 3.2.0	3.2.0	Patch available	CNA
Thelia	Thelia Back-office Default Twig Template	before 1.2.0	1.2.0	Patch available	CNA
Thelia	Thelia Back-office Default Template	up to 2.6.2	—	No fix listed	CNA
Thelia	Thelia Smarty Module	up to 3.0.3	—	No fix listed	CNA

Thelia VendorThelia Affected before 3.2.0 Fixed in 3.2.0 Patch available CNA
Thelia Core VendorThelia Affected before 3.2.0 Fixed in 3.2.0 Patch available CNA
Thelia Back-office Default Twig Template VendorThelia Affected before 1.2.0 Fixed in 1.2.0 Patch available CNA
Thelia Back-office Default Template VendorThelia Affected up to 2.6.2 Fixed in — No fix listed CNA
Thelia Smarty Module VendorThelia Affected up to 3.0.3 Fixed in — No fix listed CNA

Remediation

Upgrade Thelia and Thelia Core to 3.2.0, and Thelia Back-office Default Twig Template to 1.2.0. The sources list no fixed version for Thelia Back-office Default Template or Thelia Smarty Module.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Fix · CNA Thelia (Thelia) Fixed in 3.2.0
Fix · CNA Thelia Core (Thelia) Fixed in 3.2.0
Fix · CNA Thelia Back-office Default Twig Template (Thelia) Fixed in 1.2.0

Timeline

2026-10-31 Threatist record created from CVE-2026-120206
2026-10-31 Alias added: GHSA-2qjc-j63h-9f97
2026-11-02 Priority changed: MEDIUM → LOW
2026-11-05 CISA SSVC decision points changed
2026-11-05 Priority changed: LOW → MEDIUM

References

Patch 2

Advisory 1

GitHub Security Advisory (GHSA-cfvv-2jvw-x2hp)

Other 2

TI-2026-83555 Stored cross-site scripting in Thelia via coupon customer names CVSS 4.0HIGH 7.4
TI-2026-83574 Cross-site request forgery in Thelia back-office product combination routes CVSS 4.0MEDIUM 6.9
TI-2026-83557 CSRF in Thelia Page Module delete routes lets attackers remove images CVSS 4.0HIGH 7.0
TI-2026-71031 CSV formula injection in Thelia exports lets visitors run spreadsheet formulas CVSS 4.0LOW 2.3
TI-2026-71005 Thelia translation editor flaws allow remote code execution CVSS 3.1HIGH 8.8
TI-2026-71032 Unrestricted file upload in Thelia allows PHP code execution CVSS 4.0HIGH 8.6

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences