CVE-2026-120249 in Back-office Default Twig Template
Summary
by MITRE • 11/01/2026
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The Thelia e-commerce platform, prior to version 1.1.1, contains a critical cross-site request forgery vulnerability within its administrative back-office interface. This flaw specifically affects the product management functionality, targeting two distinct API endpoints: /admin/product/combinations/update and /admin/product/default-price/update. These routes are designed to modify detailed attributes of products sold through the platform, such as pricing structures, inventory levels, and physical specifications. The core technical deficiency lies in the HTTP method handling for these specific endpoints; they accept GET requests without implementing any form of anti-CSRF token validation or origin verification mechanisms. In secure web application design, state-changing operations should typically be performed via POST, PUT, or DELETE methods accompanied by strict CSRF protections to ensure that a request originates from an authorized user session and not from a malicious third-party site. By allowing these sensitive updates over GET requests without additional safeguards, the application fails to distinguish between legitimate administrative actions initiated by users and forged requests crafted by attackers.
The operational impact of this vulnerability is severe for any organization relying on Thelia for online sales operations. An attacker can exploit this flaw by constructing a malicious URL that encodes specific parameters intended to alter product data. When an authenticated administrator, who possesses the necessary privileges to manage products, clicks or navigates to this crafted link while logged into their session, the browser automatically includes any existing authentication cookies with the request. Consequently, the server processes the update as if it were a legitimate action performed by the administrator. The attacker can manipulate critical product attributes including combination prices, stock quantities, weight measurements, EAN codes, and sale flags. A particularly dangerous aspect of this vulnerability is the ability to zero out omitted prices, which could effectively render products free or drastically reduce their value in the system database. This manipulation compromises data integrity and can lead to significant financial losses if customers are able to purchase items at manipulated low costs or no cost due to altered pricing logic.
From a classification perspective, this vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery (CSRF) as an attack that tricks the victim into submitting a malicious request. It also relates to CWE-614, concerning Sensitive Cookie in HTTPS Session Without HttpOnly Flag if cookies are not properly secured, although the primary issue here is the lack of CSRF tokens rather than cookie attributes alone. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1534, which covers Internal Spearphishing or similar social engineering vectors used to deliver malicious links that trigger state-changing actions within a trusted application. The attacker leverages the trust relationship between the victim's browser and the Thelia server, exploiting the automatic inclusion of session credentials to bypass authentication controls for specific administrative functions.
To mitigate this vulnerability, immediate action is required by upgrading the Thelia installation to version 1.1.1 or later where these endpoints have been patched with proper CSRF protections. For organizations unable to upgrade immediately due to compatibility constraints, a temporary mitigation involves implementing server-side checks that require anti-CSRF tokens for all state-changing GET requests, although this may break existing functionality if not carefully managed. Alternatively, restricting access to the /admin/product/combinations/update and /admin/product/default-price-update routes via IP whitelisting or additional multi-factor authentication can reduce the attack surface. Furthermore, developers should ensure that all future API endpoints adhere to OWASP guidelines by using POST methods for mutations and enforcing strict CSRF token validation on every request that modifies application state. Regular security audits of administrative interfaces are essential to identify similar patterns where GET requests are incorrectly used for destructive or modifying operations without adequate authentication checks beyond session cookies.