CVE-2026-120206

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and...

CVE-2026-120206

Thelia versions prior to 3.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw in the back office. The root cause is that per-session CSRF tokens leak via URL query strings , allowing attackers to intercept and reuse them. Additionally, the presence of unprotected actions—specifically ...

EUVD-2026-114727

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and...

CVE-2026-120206 Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and...

CVE-2026-120206: Thelia: Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to…

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and...