Live › vulnerability › CVE-2026-120249
Thelia's default back-office Twig template, before version 1.1.1, has product update routes that accept GET requests without anti-CSRF token checks. An attacker can trick a logged-in administrator into opening a crafted link that changes product combination prices, stock, weight, EAN codes and sale flags, and can zero out omitted prices.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Shops running Thelia with a back-office template older than 1.1.1 are exposed. The attack needs a logged-in administrator to open a crafted link, so the risk is limited to administrators who browse other sites while signed in. Storefronts without a back-office exposure of these routes are less exposed.
No product ranges from the sources yet.
1.1.1 in the project's composer.lock or the admin footer./admin/product/combinations/update and /admin/product/default-price/update are reachable from the internet.1.1.1 are affected; move to 1.1.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.
This page as .md · .json · in your agent: get_signal("CVE-2026-120249")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.