---
id: "CVE-2026-120206"
kind: "vulnerability"
aliases: ["CVE-2026-120206"]
title: "Thelia: back office CSRF lets attackers forge admin actions"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["e-commerce", "other", "php", "self-hosted", "thelia"]
not_affected_if: ["no-back-office-admin-sessions", "version-3.2.0-or-later"]
published_at: "2026-10-31T18:17:08+00:00"
first_seen_at: "2026-10-31T18:37:12+00:00"
updated_at: "2026-10-31T18:40:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120206", "first_seen_at": "2026-10-31T18:37:12+00:00"}]
---

# Thelia: back office CSRF lets attackers forge admin actions

Thelia is an open-source e-commerce platform written in PHP. Before version 3.2.0, per-session CSRF tokens leak through URL query strings and some back office actions lack protection, so an attacker can make a logged-in administrator hide, delete or reorder catalogue and configuration objects.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Thelia version in the project's composer.json or lock file; anything below `3.2.0` is in range.
- Look for back office URLs containing a CSRF token parameter in web server access logs or in admin links.

## Fix

- Upgrade Thelia to `3.2.0` or later.

## Timeline

- 2026-10-31T18:37:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120206

## From the sources

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_