CVE-2026-120207 Thelia CVE debrief

Who should care

Defenders responsible for Thelia installations, particularly those using the Page Module, should assess exposure and apply remediation to prevent potential CSRF attacks. This includes administrators and security teams managing Thelia-based websites.

Why it matters

The CVE-2026-120207 vulnerability in Thelia Page Module allows remote attackers to delete page tags, documents, and images via CSRF attacks. Defenders should verify exposure, apply remediation, and enhance permission checks to prevent unauthorized actions.

• Defenders need to verify exposure and apply remediation to prevent potential CSRF attacks.
• Security teams should review and enhance existing permission checks for back-office delete routes.
• Administrators must ensure that Thelia Page Module versions are updated to 2.0.4 or later.

Technical summary

The Thelia Page Module before version 2.0.4 contains a cross-site request forgery (CSRF) vulnerability. This vulnerability allows remote attackers to delete page tags, documents, and images by abusing back-office delete routes that lack CSRF tokens and permission checks. The vulnerability can be exploited by luring a logged-in administrator into navigating to crafted GET requests that sequentially remove TheliaLibrary images, their files, and variants across pages, products, and categories.

Defensive priority

Defenders should prioritize verifying exposure and applying the vendor's remediation to prevent potential CSRF attacks.

Recommended defensive actions

• Verify if the Thelia Page Module version is before 2.0.4 and update to 2.0.4 or later if necessary.
• Implement additional monitoring to detect potential CSRF attacks targeting the delete routes.
• Review and enhance the existing permission checks for back-office delete routes to prevent unauthorized actions.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by Vulncheck and is publicly disclosed in various sources, including GitHub advisories and Vulncheck's own advisory. However, details about the number of affected users or specific exploitation attempts are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.