CVE-2026-120206 Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-120206?
CVE-2026-120206 is a medium-severity vulnerability in Thelia, published on 31 Oct 2026.
Official description
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
Weakness: CWE-352
Which versions are affected by CVE-2026-120206?
How do I fix CVE-2026-120206?
No fix has been published for CVE-2026-120206 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-120206 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-120206 exists.
Sources
Also known as GHSA-2qjc-j63h-9f97, GHSA-cfvv-2jvw-x2hp.