CVE-2026-120206 Thelia CVE debrief

Who should care

Defenders responsible for Thelia instances, especially those with publicly accessible back office interfaces, should assess exposure and implement compensating controls to prevent unauthorized administrative actions. This includes verifying instance exposure, implementing additional security measures, and monitoring for suspicious activity.

Why it matters

Thelia before 3.2.0 is vulnerable to cross-site request forgery attacks in its back office due to leaking CSRF tokens and unprotected actions. Defenders responsible for Thelia instances should assess exposure and implement compensating controls to prevent unauthorized administrative actions.

• Attackers can forge administrative actions, potentially leading to unauthorized changes to catalogue and configuration objects.
• Logged-in administrators may be tricked into performing unintended actions, such as deleting or reordering objects.
• The vulnerability allows for CSRF attacks, which can be particularly problematic for Thelia instances with publicly accessible back office interfaces.
• Defenders need to verify exposure and implement compensating controls to prevent exploitation.

Technical summary

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office due to per-session CSRF tokens leaking via URL query strings. Attackers can reuse leaked tokens or target unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects. This vulnerability is particularly problematic for Thelia instances with publicly accessible back office interfaces, and defenders should prioritize verifying exposure and implementing compensating controls.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls for Thelia instances, especially those with publicly accessible back office interfaces.

Recommended defensive actions

• Verify Thelia instance exposure, especially for publicly accessible back office interfaces.
• Implement compensating controls, such as IP restrictions or additional authentication mechanisms, for Thelia back office access.
• Monitor for suspicious activity related to Thelia administrative actions.
• Update to Thelia version 3.2.0 or later if available.
• Review and adjust security configurations for Thelia instances.
• Conduct regular security audits to identify potential vulnerabilities.
• Implement a Web Application Firewall (WAF) to detect and prevent CSRF attacks.

Evidence notes

The vulnerability is caused by per-session CSRF tokens leaking via URL query strings, allowing attackers to reuse leaked tokens or target unprotected actions. The source details are limited, and defenders should verify exposure and implement compensating controls to prevent exploitation. The official CVE record and NVD detail page provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.