CVE-2026-120206 in Thelia
Summary
by MITRE • 10/31/2026
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Thelia versions prior to 3.2.0 represents a critical failure in session management and request validation mechanisms within the administrative interface. This cross-site request forgery flaw stems from an improper handling of security tokens that are intended to prevent unauthorized state-changing requests. Specifically, the per-session CSRF tokens are inadvertently exposed through URL query strings during normal operation or specific interactions with the back office application. In a secure implementation, such sensitive authentication credentials should be transmitted exclusively via HTTP headers or hidden form fields within POST requests, ensuring they remain invisible in browser history, server logs, and referrer headers. The leakage of these tokens into the URI allows any party capable of observing network traffic or accessing shared browsing sessions to capture valid session identifiers that can then be replayed by an attacker to impersonate legitimate users.
From a technical perspective, this flaw enables attackers to forge administrative actions without requiring additional authentication steps beyond possessing the leaked token. The vulnerability is particularly severe because it targets specific unprotected endpoints within the application logic, namely setToggleVisibilityAction and updatePositionAction. These functions are designed to manage the visibility status and ordering of catalogue items and configuration objects but lack sufficient validation checks against forged requests when combined with the compromised token mechanism. Consequently, an attacker can craft malicious URLs or scripts that utilize these actions while injecting the stolen CSRF token into the request parameters. This allows the execution of commands as if they were initiated by a logged-in administrator, bypassing standard security controls designed to mitigate cross-site scripting and forgery attacks.
The operational impact of this vulnerability is significant for organizations relying on Thelia for e-commerce or content management operations. Attackers can exploit this weakness to delete critical catalogue entries, hide products from public view which directly impacts revenue streams, or reorder items in a manner that disrupts business logic and user experience. Furthermore, the ability to modify configuration objects may lead to broader system compromise if such changes affect security settings, payment gateways, or integration endpoints. Since the attack relies on social engineering techniques such as phishing links or malicious websites hosting exploit code, it poses a persistent threat to administrators who may inadvertently trigger these forged requests while logged into their administrative dashboards. The persistence of valid tokens across sessions exacerbates the risk, allowing for delayed exploitation long after the initial token leak occurred.
To mitigate this vulnerability, immediate updates to Thelia version 3.2.0 or later are required as they address the underlying architectural flaws in CSRF protection. In environments where upgrading is not immediately feasible, administrators should implement strict access controls and monitor logs for unusual patterns of request parameters containing session tokens. It is also advisable to configure web application firewalls to detect and block requests that exhibit characteristics of forged CSRF attempts, such as missing or malformed security headers. Additionally, enforcing the use of HTTPS ensures that token leakage via referrer headers is minimized during transmission between client and server. Regular audits of authentication flows should be conducted to ensure no sensitive data is exposed in URLs, aligning with industry standards for secure session management.
This vulnerability maps directly to CWE-352 Cross-Site Request Forgery within the Common Weakness Enumeration framework, highlighting a failure to verify that an intended sender initiated a particular request. Furthermore, it relates to CWE-200 Information Exposure where sensitive security tokens are inadvertently disclosed through URI parameters. From an offensive perspective, this aligns with MITRE ATT&CK technique T1566.002 Phishing: Spearphishing Link, as the attack vector typically involves tricking a user into clicking a malicious link that triggers the forged request in their active session. Addressing these issues requires both technical remediation of the codebase and enhanced security awareness training for administrative users to recognize potential phishing attempts targeting privileged accounts.