CVE-2026-120207 in Page Module
Summary
by MITRE • 10/31/2026
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in Thelia Page Module versions prior to 2.0.4 represents a critical failure in access control mechanisms within the administrative interface of the content management system. This flaw is classified as Cross-Site Request Forgery (CSRF), which allows an attacker to trick a authenticated user into performing unintended actions on behalf of that user without their consent. In this specific instance, the vulnerability affects the back-office delete routes responsible for managing page tags, documents, and images. The core technical deficiency lies in the absence of anti-CSRF tokens and insufficient permission checks within these HTTP endpoints. Because the application relies solely on session cookies to authenticate requests rather than validating a unique, unpredictable token associated with each user session or request, it fails to distinguish between legitimate administrative actions and maliciously forged requests initiated by third-party sites.
The operational impact of this vulnerability is severe due to its potential for automated data destruction through sequential ID enumeration. Attackers can craft simple GET requests that iterate through numerical identifiers corresponding to various assets within the Thelia ecosystem, including library images, their associated files, variants, and metadata linked to pages, products, and categories. By luring a logged-in administrator with administrative privileges into visiting a malicious webpage or clicking a crafted link, the attacker triggers these delete operations automatically in the background of the victim's browser session. This results in the irreversible deletion of critical digital assets, leading to significant data loss and operational disruption for e-commerce businesses relying on Thelia for their online presence. The lack of confirmation dialogs or secondary authentication steps further exacerbates the risk, allowing bulk destruction of content with minimal effort from the attacker.
From a security standards perspective, this vulnerability aligns directly with CWE-352: Cross-Site Request Forgery (CSRF), which describes situations where an application uses user credentials to perform state-changing actions without verifying that the request was intentionally made by the user. Additionally, it relates to CWE-862: Missing Authorization, as the system fails to enforce proper access controls on sensitive administrative functions. In terms of offensive security frameworks such as MITRE ATT&CK, this technique falls under T1556.003: Modifying Authentication Process via CSRF, although in this case it is more accurately described as leveraging authenticated sessions for unauthorized state changes rather than modifying the authentication process itself. The exploitation vector corresponds to social engineering tactics where trust in a user's session is abused to execute malicious commands.
To mitigate this vulnerability and prevent similar issues in future development cycles, immediate remediation should focus on implementing robust anti-CSRF protections across all administrative endpoints that modify system state. This includes integrating unique, cryptographically secure tokens into forms and AJAX requests that are validated server-side before processing any delete or update operations. Furthermore, developers must enforce strict permission checks to ensure that only users with explicit admin roles can access these routes, regardless of whether a valid session cookie is present. Implementing SameSite cookie attributes set to Strict or Lax can also provide an additional layer of defense by preventing browsers from sending cookies in cross-site request contexts. Regular security audits and the adoption of secure coding practices such as those outlined in OWASP guidelines are essential for maintaining the integrity of web applications against CSRF attacks.