CVE-2026-120249

Name of the Vulnerable Software and Affected Versions Thelia Back-office Default Twig Template versions prior to 1.1.1

Description A cross-site request forgery issue exists where the '/admin/product/combinations/update' and '/admin/product/default-price/update' endpoints accept GET requests without verifying anti-CSRF tokens. This allows an attacker to trick an authenticated administrator into clicking a malicious link to modify product combination details, including prices, stock, weight, EAN, and sale flags, potentially resetting omitted prices to zero.

Recommendations Update to version 1.1.1 or later.