{"id":"CVE-2026-120249","kind":"vulnerability","aliases":["CVE-2026-120249"],"related":[],"title":"Thelia: back-office forms let a crafted link rewrite product prices and stock","description":"Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.","summary":"Thelia's default back-office Twig template, before version 1.1.1, has product update routes that accept GET requests without anti-CSRF token checks. An attacker can trick a logged-in administrator into opening a crafted link that changes product combination prices, stock, weight, EAN codes and sale flags, and can zero out omitted prices.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","other","php","self-hosted","thelia"],"not_affected_if":["no-admin-users-browsing-while-logged-in","version-1.1.1-or-later"],"how_to_check":"- Check the installed Thelia version against `1.1.1` in the project's composer.lock or the admin footer.\n- Confirm whether the back-office routes `/admin/product/combinations/update` and `/admin/product/default-price/update` are reachable from the internet.","fix":"- Thelia versions before `1.1.1` are affected; move to `1.1.1` or later.","status":"open","published_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","triaged_at":"2026-11-01T01:47:34+00:00","updated_at":"2026-11-01T01:47:34+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-01T01:47:34Z","model":"claude-haiku-5-5","output":{"fix":"- Thelia versions before `1.1.1` are affected; move to `1.1.1` or later.","reach":"internet","title":"Thelia: back-office forms let a crafted link rewrite product prices and stock","impact":"medium","summary":"Thelia's default back-office Twig template, before version 1.1.1, has product update routes that accept GET requests without anti-CSRF token checks. An attacker can trick a logged-in administrator into opening a crafted link that changes product combination prices, stock, weight, EAN codes and sale flags, and can zero out omitted prices.","audience":"businesses","category":"other","nicknames":[],"who_cares":["thelia","php","e-commerce","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Product prices, stock and sale flags altered without admin consent","analyst_note":"","how_to_check":"- Check the installed Thelia version against `1.1.1` in the project's composer.lock or the admin footer.\n- Confirm whether the back-office routes `/admin/product/combinations/update` and `/admin/product/default-price/update` are reachable from the internet.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.1.1-or-later","no-admin-users-browsing-while-logged-in"],"who_is_affected":"Shops running Thelia with a back-office template older than 1.1.1 are exposed. The attack needs a logged-in administrator to open a crafted link, so the risk is limited to administrators who browse other sites while signed in. Storefronts without a back-office exposure of these routes are less exposed.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4174,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120249':17A,20A '-2026':16A,19A '/admin/product/combinations/update':106C '/admin/product/default-price/update':108C '1.1.1':40B,95C 'accept':46B,111C 'administr':63B,127C 'anti':51B,116C 'anti-csrf':50B,115C 'attack':56B,120C 'back':3A,34B,89C 'back-offic':2A,33B,88C 'chang':70B 'check':54B,119C 'code':77B 'combin':72B,136C 'commerc':23B 'contain':96C 'craft':8A,67B,131C 'cross':99C 'cross-sit':98C 'csrf':52B,117C 'cve':15A,18A 'default':32B,91C 'e':22B 'e-commerc':21B 'ean':76B,140C 'flag':80B,143C 'follow':129C 'forgeri':102C 'form':5A 'get':47B,112C 'host':28B 'let':6A 'link':9A,68B,132C 'log':61B,125C 'logged-in':60B,124C 'lure':122C 'offic':4A,35B,90C 'omit':85B,145C 'open':65B 'php':25B 'price':12A,73B,86B,137C,146C 'product':11A,42B,71B,135C 'request':48B,101C,113C 'rewrit':10A,134C 'rout':44B,109C 'sale':79B,142C 'self':27B 'self-host':26B 'site':100C 'stock':14A,74B,138C 'templat':37B,93C 'thelia':1A,29B,30B,87C 'token':53B,118C 'trick':58B 'twig':36B,92C 'updat':43B 'version':39B 'vulner':103C 'weight':75B,139C 'without':49B,114C 'zero':83B,144C","nicknames":[],"mitigations":[],"who_affected":"Shops running Thelia with a back-office template older than 1.1.1 are exposed. The attack needs a logged-in administrator to open a crafted link, so the risk is limited to administrators who browse other sites while signed in. Storefronts without a back-office exposure of these routes are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T01:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120249","severity":null,"published_at":"2026-11-01T01:17:18+00:00","modified_at":"2026-11-01T01:17:18+00:00","first_seen_at":"2026-11-01T01:47:22+00:00","fetched_at":"2026-11-01T01:47:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}