CVE-2026-120249 Thelia CVE debrief

Who should care

Defenders responsible for Thelia installations, particularly those using Thelia Back-office Default Twig Template versions before 1.1.1, should assess exposure and apply the vendor-provided patch.

Why it matters

The CVE-2026-120249 vulnerability in Thelia Back-office Default Twig Template before version 1.1.1 allows attackers to manipulate product information by luring logged-in administrators into following crafted links. Defenders should prioritize verifying exposure and applying the vendor-provided patch.

• An attacker could rewrite product combination prices, potentially leading to financial losses or inventory inconsistencies.
• An attacker could modify stock levels, weight, EAN, and sale flags, affecting inventory management and product information.
• Defenders need to verify exposure of affected Thelia installations and apply patches to prevent potential attacks.
• Defenders should monitor for suspicious activity on product combination and price updates to detect potential exploitation attempts.

Technical summary

The vulnerability exists in the /admin/product/combinations/update and /admin/product/default-price/update routes of Thelia Back-office Default Twig Template before version 1.1.1. These routes accept GET requests without anti-CSRF token checks, allowing attackers to manipulate product combination prices, stock, weight, EAN, and sale flags by luring logged-in administrators into following crafted links.

Defensive priority

Defenders should prioritize verifying exposure of Thelia Back-office Default Twig Template versions before 1.1.1 and applying the vendor-provided patch.

Recommended defensive actions

• Verify exposure of Thelia Back-office Default Twig Template versions before 1.1.1
• Apply the vendor-provided patch to update to version 1.1.1 or later
• Implement anti-CSRF token checks for the affected routes
• Monitor for suspicious activity on product combination and price updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in Thelia Back-office Default Twig Template before version 1.1.1 and the lack of anti-CSRF token checks in specific routes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.