CVE-2026-120206

Name of the Vulnerable Software and Affected Versions Thelia versions prior to 3.2.0

Description A cross-site request forgery issue exists in the back office where per-session CSRF tokens leak through URL query strings. This allows attackers to forge administrative actions by reusing leaked tokens or targeting the unprotected setToggleVisibilityAction() and updatePositionAction() functions. Consequently, authenticated administrators may be tricked into deleting, hiding, or reordering configuration and catalogue objects.

Recommendations Update to version 3.2.0 or later. As a temporary mitigation, restrict access to the setToggleVisibilityAction() and updatePositionAction() functions.