{"id":"CVE-2026-120206","kind":"vulnerability","aliases":["CVE-2026-120206"],"related":[],"title":"Thelia: back office CSRF lets attackers forge admin actions","description":"Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.","summary":"Thelia is an open-source e-commerce platform written in PHP. Before version 3.2.0, per-session CSRF tokens leak through URL query strings and some back office actions lack protection, so an attacker can make a logged-in administrator hide, delete or reorder catalogue and configuration objects.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","other","php","self-hosted","thelia"],"not_affected_if":["no-back-office-admin-sessions","version-3.2.0-or-later"],"how_to_check":"- Check the installed Thelia version in the project's composer.json or lock file; anything below `3.2.0` is in range.\n- Look for back office URLs containing a CSRF token parameter in web server access logs or in admin links.","fix":"- Upgrade Thelia to `3.2.0` or later.","status":"open","published_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","triaged_at":"2026-10-31T18:40:39+00:00","updated_at":"2026-10-31T18:40:39+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-31T18:40:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Thelia to `3.2.0` or later.","reach":"internet","title":"Thelia: back office CSRF lets attackers forge admin actions","impact":"medium","summary":"Thelia is an open-source e-commerce platform written in PHP. Before version 3.2.0, per-session CSRF tokens leak through URL query strings and some back office actions lack protection, so an attacker can make a logged-in administrator hide, delete or reorder catalogue and configuration objects.","audience":"businesses","category":"other","nicknames":[],"who_cares":["thelia","php","e-commerce","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"administrator actions forged, catalogue and configuration objects deleted or altered","analyst_note":"","how_to_check":"- Check the installed Thelia version in the project's composer.json or lock file; anything below `3.2.0` is in range.\n- Look for back office URLs containing a CSRF token parameter in web server access logs or in admin links.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.2.0-or-later","no-back-office-admin-sessions"],"who_is_affected":"Shops and sites running Thelia before 3.2.0 with the back office in use. An attacker needs a logged-in administrator to visit a malicious page, so exposure depends on whether administrators browse other sites while signed in to the back office. Sites on 3.2.0 or later are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4163,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120206':12A,15A '-2026':11A,14A '3.2.0':40B,78C 'action':9A,55B,97C 'admin':8A 'administr':67B,96C,126C 'allow':92C 'attack':6A,60B,93C,109C 'back':2A,53B,89C 'catalogu':72B,131C 'commerc':18B,33B 'configur':74B,133C 'contain':79C 'cross':82C 'cross-sit':81C 'csrf':4A,44B,102C 'cve':10A,13A 'delet':69B,127C 'e':17B,32B 'e-commerc':16B,31B 'forg':7A,95C 'forgeri':85C 'hide':68B,128C 'host':23B 'lack':56B 'leak':46B,104C,112C 'let':5A 'log':65B,124C 'logged-in':64B,123C 'make':62B,122C 'object':75B,134C 'offic':3A,54B,90C 'open':29B 'open-sourc':28B 'per':42B,100C 'per-sess':41B,99C 'php':20B,37B 'platform':34B 'protect':57B 'queri':49B,107C 'reorder':71B,130C 'request':84C 'reus':111C 'self':22B 'self-host':21B 'session':43B,101C 'settogglevisibilityact':118C 'site':83C 'sourc':30B 'string':50B,108C 'target':115C 'thelia':1A,24B,25B,76C 'token':45B,103C,113C 'unprotect':117C 'updatepositionact':120C 'url':48B,106C 'version':39B 'via':105C 'vulner':86C 'written':35B","nicknames":[],"mitigations":[],"who_affected":"Shops and sites running Thelia before 3.2.0 with the back office in use. An attacker needs a logged-in administrator to visit a malicious page, so exposure depends on whether administrators browse other sites while signed in to the back office. Sites on 3.2.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120206","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120206","severity":null,"published_at":"2026-10-31T18:17:08+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:12+00:00","fetched_at":"2026-10-31T18:37:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}