Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120206— Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Quick assessment

Affected

Thelia Thelia

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Thelia 3.2.0 之前的版本在后端管理界面中存在跨站请求伪造（CSRF）漏洞。由于会话级 CSRF 令牌通过 URL 查询字符串泄露，攻击者可伪造管理操作。攻击者能够重用已泄露的令牌，或利用未受保护的和接口，诱导已登录的管理员删除、隐藏或重新排序目录及配置对象。

CVSS 5.9 · Medium Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1566.001 · Spearphishing Attachment T1190 · Exploit Public-Facing Application

Affected Version Matrix 5

Vendor	Product	Version Range	Status
Thelia	Thelia	`< 3.2.0`	affected
Thelia	Thelia Back-office Default Template	`≤ 2.6.2`	affected
Thelia	Thelia Back-office Default Twig Template	`< 1.2.0`	affected
Thelia	Thelia Core	`< 3.2.0`	affected
Thelia	Thelia Smarty Module	`≤ 3.0.3`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Source: CVE Program / CVE List V5

Vulnerability Description

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

跨站请求伪造(CSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
Thelia	Thelia	0 ~ 3.2.0	-
Thelia	Thelia Core	0 ~ 3.2.0	-
Thelia	Thelia Back-office Default Twig Template	0 ~ 1.2.0	-
Thelia	Thelia Back-office Default Template	0 ~ 2.6.2	-
Thelia	Thelia Smarty Module	0 ~ 3.0.3	-

II. Public POCs for CVE-2026-120206

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120206

请登录查看更多情报信息。

Other References for CVE-2026-120206 (6)

https://github.com/thelia/thelia/blob/3.1.6/core/lib/Thelia/Controller/Admin/AbstractCrudController.php#L466 technical-description
https://github.com/thelia/thelia/commit/55a7156e552d0b8145309b10175d13ecc1187433 patch
https://github.com/thelia-templates/default-twig/commit/a9647682572de056ba258a2d4d53e42f5b591b84 patch
https://github.com/thelia/thelia/releases/tag/3.2.0 release-notes
https://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp vendor-advisory
https://www.vulncheck.com/advisories/thelia-before-3.2.0-back-office-csrf-via-url-token-and-unprotected-actions third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120206

Same Patch Batch · Thelia · 2026-10-31 · 3 CVEs total

CVE-2026-120205	8.0 HIGH	Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
CVE-2026-120207	7.1 HIGH	Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

IV. Related Vulnerabilities

Same product: Thelia

Same vendor: Thelia

Same weakness: CWE-352