CVE-2026-120206
Medium
Description
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Thelia
PublishedOct 31, 2026
First seenNov 4, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- Thelia Thelia3.2.0 or later
- Thelia Thelia Core3.2.0 or later
- Thelia Thelia Back-office Default Twig Template1.2.0 or later
Patches
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Thelia Thelia | v < 3.2.0 | 3.2.0 |
| Thelia Thelia Core | v < 3.2.0 | 3.2.0 |
| Thelia Thelia Back-office Default Twig Template | v < 1.2.0 | 1.2.0 |
| Thelia Thelia Back-office Default Template | v ≤ 2.6.2 | — |
| Thelia Thelia Smarty Module | v ≤ 3.0.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.