Live › vulnerability › CVE-2026-120207
The Thelia Page Module before 2.0.4 has back-office delete routes that lack CSRF tokens and permission checks. An attacker who lures a logged-in administrator to a crafted link can delete page tags, documents and images across the shop.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 18:37 UTC. All times on this page are UTC.
Thelia shops that run the Page Module before 2.0.4 and have administrators who are logged in to the back office. The delete routes are reached through a victim's browser, so exposure depends on an admin visiting an attacker-controlled page while signed in. Shops without the Page Module, or already on 2.0.4 or later, are not affected.
No product ranges from the sources yet.
modules directory or admin module list; it is affected below 2.0.4.2.0.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.
This page as .md · .json · in your agent: get_signal("CVE-2026-120207")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.