Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Thelia
  • Thelia
  • Thelia Back-office Default Template
  • Thelia Back-office Default Twig Template
  • Thelia Smarty Module

No data.

No data.

References
Link Providers
https://github.com/thelia-templates/default-twig/commit/a9647682572de056ba258a2d4d53e42f5b591b84 cve-icon cve-icon
https://github.com/thelia/thelia/blob/3.1.6/core/lib/Thelia/Controller/Admin/AbstractCrudController.php#L466 cve-icon cve-icon
https://github.com/thelia/thelia/commit/55a7156e552d0b8145309b10175d13ecc1187433 cve-icon cve-icon
https://github.com/thelia/thelia/releases/tag/3.2.0 cve-icon cve-icon
https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp cve-icon cve-icon cve-icon
https://www.vulncheck.com/advisories/thelia-before-3.2.0-back-office-csrf-via-url-token-and-unprotected-actions cve-icon cve-icon
History

Thu, 05 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Thelia
Thelia thelia
Thelia thelia Back-office Default Template
Thelia thelia Back-office Default Twig Template
Thelia thelia Smarty Module
Vendors & Products Thelia
Thelia thelia
Thelia thelia Back-office Default Template
Thelia thelia Back-office Default Twig Template
Thelia thelia Smarty Module

Sat, 31 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
Title Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-31T17:25:54.151Z

Updated: 2026-11-05T15:33:23.336Z

Reserved: 2026-10-31T11:44:48.549Z

Link: CVE-2026-120206

cve-icon Vulnrichment

Updated: 2026-11-05T15:33:15.641Z

cve-icon NVD

Status : Deferred

Published: 2026-10-31T18:17:08.747

Modified: 2026-11-05T16:17:41.877

Link: CVE-2026-120206

cve-icon Redhat

No data.