CVE-2026-120206

Thelia versions prior to 3.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the back office. The root cause is that per-session CSRF tokens leak via URL query strings , allowing attackers to intercept and reuse them. Additionally, the presence of unprotected actions—specifically ...