Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
Thelia Page Module versions before 2.0.4 are affected, through the bundled CMS module's page-tag, page-document and page-image delete routes. Fixed in 2.0.4.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 2.0.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Page module for Thelia, an open-source e-commerce content management platform, is affected. Remote attackers can trick a logged-in administrator into triggering actions that delete page tags, documents, and images, including their files, across the store's pages, products, and categories.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Thelia Thelia Page Module
fixed in 2.0.4
References 4
GitHub · thelia/thelia
GitHub · thelia-modules/Page
Questions about CVE-2026-120207
What does this mean?
The Page module's delete routes do not block cross-site requests. If a logged-in administrator visits an attacker's page in the same browser, the page can trigger deletions that permanently remove shop content, including database rows and physical files. Shared media library images used by products, categories and pages can be removed too, because the affected ids are sequential.Source: github.com
Am I affected, and how do I check?
Thelia Page Module versions before 2.0.4 are affected. The issue is in the bundled CMS module's page-tag, page-document and page-image delete routes. To check, look up the installed version of the Thelia Page Module in the shop's administration.Source: github.com
What should I do about it?
Upgrade the Thelia Page Module to version 2.0.4 or later, which contains the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data