{"id":"CVE-2026-120207","kind":"vulnerability","aliases":["CVE-2026-120207"],"related":[],"title":"Thelia Page Module: CSRF lets attackers delete back-office pages, images and documents","description":"Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.","summary":"The Thelia Page Module before 2.0.4 has back-office delete routes that lack CSRF tokens and permission checks. An attacker who lures a logged-in administrator to a crafted link can delete page tags, documents and images across the shop.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","page-module","php","thelia"],"not_affected_if":["module-not-installed","no-admin-browsing-while-logged-in","patched-2.0.4-or-later"],"how_to_check":"- Check the installed version of the Thelia Page Module in the Thelia `modules` directory or admin module list; it is affected below `2.0.4`.\n- Confirm whether the shop's admin area is used by logged-in administrators who browse other sites.","fix":"- Thelia Page Module: `2.0.4` or later","status":"open","published_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:13+00:00","triaged_at":"2026-10-31T18:40:35+00:00","updated_at":"2026-10-31T18:40:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T18:40:35Z","model":"claude-haiku-5-5","output":{"fix":"- Thelia Page Module: `2.0.4` or later","reach":"internet","title":"Thelia Page Module: CSRF lets attackers delete back-office pages, images and documents","impact":"medium","summary":"The Thelia Page Module before 2.0.4 has back-office delete routes that lack CSRF tokens and permission checks. An attacker who lures a logged-in administrator to a crafted link can delete page tags, documents and images across the shop.","audience":"businesses","category":"package","nicknames":[],"who_cares":["thelia","page-module","ecommerce","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker deletes pages, images, documents and their files via admin session","analyst_note":"","how_to_check":"- Check the installed version of the Thelia Page Module in the Thelia `modules` directory or admin module list; it is affected below `2.0.4`.\n- Confirm whether the shop's admin area is used by logged-in administrators who browse other sites.","plain_action":"","needs_analyst":false,"not_affected_if":["module-not-installed","patched-2.0.4-or-later","no-admin-browsing-while-logged-in"],"who_is_affected":"Thelia shops that run the Page Module before 2.0.4 and have administrators who are logged in to the back office. The delete routes are reached through a victim's browser, so exposure depends on an admin visiting an attacker-controlled page while signed in. Shops without the Page Module, or already on 2.0.4 or later, are not affected.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4169,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120207':17A,20A '-2026':16A,19A '2.0.4':33B,74C 'abus':95C 'across':67B,132C 'administr':55B,114C 'allow':84C 'attack':6A,48B,86C,107C 'back':9A,36B,97C 'back-offic':8A,35B,96C 'categori':136C 'check':46B,106C 'contain':75C 'craft':58B,118C 'cross':78C 'cross-sit':77C 'csrf':4A,42B,102C 'cve':15A,18A 'delet':7A,38B,61B,88C,99C 'document':14A,64B,91C 'ecommerc':21B 'file':129C 'forgeri':81C 'get':119C 'id':124C 'imag':12A,66B,93C,127C 'lack':41B,101C 'let':5A 'link':59B 'log':53B,112C 'logged-in':52B,111C 'lure':50B,109C 'modul':3A,25B,31B,72C 'navig':116C 'offic':10A,37B,98C 'packag':22B 'page':2A,11A,24B,30B,62B,71C,89C,133C 'page-modul':23B 'permiss':45B,105C 'php':26B 'product':134C 'remot':85C 'remov':125C 'request':80C,120C 'rout':39B,100C 'sequenti':123C 'shop':69B 'site':79C 'tag':63B,90C 'thelia':1A,27B,29B,70C 'thelialibrari':126C 'token':43B,103C 'variant':131C 'vulner':82C 'walk':122C","nicknames":[],"mitigations":[],"who_affected":"Thelia shops that run the Page Module before 2.0.4 and have administrators who are logged in to the back office. The delete routes are reached through a victim's browser, so exposure depends on an admin visiting an attacker-controlled page while signed in. Shops without the Page Module, or already on 2.0.4 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120207","severity":null,"published_at":"2026-10-31T18:17:08+00:00","modified_at":"2026-10-31T18:17:08+00:00","first_seen_at":"2026-10-31T18:37:13+00:00","fetched_at":"2026-10-31T18:37:13+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}