Skip to content

CVE record · 1 source

CVE-2026-120206

CVSS 5.9

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions…

Vendor: Thelia
Product: Thelia, Thelia Core, Thelia Back-office Default Twig Template, Thelia Back-office Default Template
CVSS v3.1: 5.9 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Weakness: CWE-352
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

23

CVE NVD 14h ago

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions…

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse…

CVSS 5.9 CVE-2026-120206 Thelia