CVE-2026-120207

Name of the Vulnerable Software and Affected Versions Thelia Page Module versions prior to 2.0.4

Description A cross-site request forgery (CSRF) issue exists where remote attackers can delete page tags, documents, and images. This occurs because back-office delete routes lack CSRF tokens—unique identifiers used to prevent unauthorized requests—and permission checks. Attackers can trick a logged-in administrator into clicking crafted GET requests that iterate through sequential IDs to remove TheliaLibrary images, including their associated files and variants, across pages, products, and categories.

Recommendations Update Thelia Page Module to version 2.0.4 or later.