Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 3.2.0, 1.2.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Thelia, an open-source e-commerce platform, is affected in versions before 3.2.0. An attacker could trick a logged-in administrator into unknowingly performing actions in the back office, such as hiding, reordering, or deleting catalogue and configuration items.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Thelia Thelia
fixed in 3.2.0
- Thelia Thelia Core
fixed in 3.2.0
- Thelia Thelia Back-office Default Twig Template
fixed in 1.2.0
- Thelia Thelia Back-office Default Template
through 2.6.2
- Thelia Thelia Smarty Module
through 3.0.3
References 6
GitHub · thelia/thelia
GitHub · thelia-templates/default-twig
Questions about CVE-2026-120206
What does this mean?
A logged-in Thelia back-office administrator who clicks a crafted link can have state-changing actions performed without meaning to. These include deleting or toggling back-office resources such as languages, modules, coupons, categories, products and customer accounts, including their visibility and activation state. The attack works because the back-office token is passed in the URL query string and the affected routes accept HTTP GET.Source: github.com
Am I affected, and how do I check?
Thelia versions before 3.2.0 are listed as affected, and the Thelia Core and Back-office Default Twig Template packages carry the same fixed version boundary. The advisory also lists older back-office template and Smarty module packages with their own last affected versions. Check your installed Thelia version in the admin footer or composer.json, and check whether your back office routes accept GET requests that carry the token in the URL.Source: github.com
What should I do about it?
Upgrade Thelia to 3.2.0 or later. The Back-office Default Twig Template should be at 1.2.0 or later, and the older template and Smarty module packages should be updated to versions that are not in their listed affected ranges.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data