Thelia CVE-2026-103526

Exploitable against any internet-reachable Thelia 2.6.0 installation by targeting the administrative login endpoint and the forgotten-password endpoint, which return distinguishable responses for invalid usernames versus incorrect passwords; no authentication, credentials, or user interaction are required. The specific enabling weakness is the absence of rate limiting or anti-automation controls on these authentication endpoints, which allows enumeration at scale. Limiting factors: the flaw only discloses which administrator accounts exist (low confidentiality impact) rather than granting access, so impact depends on chaining with subsequent credential attacks; exploitation requires network reachability of the admin panel, which may be IP-restricted or VPN-gated in hardened deployments.

This is a genuinely low-priority issue by most signals, consistent with the input CVSS base score of 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N): network-reachable and unauthenticated (PR:N), but with only low confidentiality impact (C:L) and no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC provided, so there is no evidence of active exploitation - treat this as no public exploit identified at time of analysis. The main point of disagreement is attack complexity: the input vector asserts AC:H, yet the description explicitly states the endpoints lack rate limiting or anti-automation protections and that enumeration 'can be performed efficiently at scale', which argues for AC:L - I assess AC:L, raising the realistic score to ~5.3. Note this is an enumeration/reconnaissance weakness (CWE-204 observable response discrepancy), not a direct compromise: its real value to an attacker is as a precursor that feeds credential-stuffing, brute-force, or phishing against confirmed admin accounts. Reporting is credible (CERT/CC VU#162329), but the single reference and absence of a vendor advisory limit independent verification.

An unauthenticated attacker scripts requests against the Thelia admin login and forgotten-password endpoints, submitting candidate usernames/emails and observing that responses differ for valid versus invalid accounts. Because there is no rate limiting, they rapidly compile a list of valid administrator accounts, which they then target with credential-stuffing or password-spray attacks. No public POC is identified, but the technique is trivial to automate given the described response discrepancy.