Thelia CVE-2026-120206

Exploitation requires a currently authenticated Thelia back-office administrator who performs active interaction - clicking a crafted link or visiting a hostile page in the same browser - because the PHPSESSID cookie is sent on top-level GET navigation under SameSite=Lax. For the delete routes, the attacker must additionally have obtained the single per-session CSRF token, which the application leaks by carrying it in the URL query string (?_token=) where it is captured by server/proxy access logs, browser history, HTTP Referer headers, or any XSS on the admin domain. The setToggleVisibilityAction and updatePositionAction actions inherited from AbstractCrudController required no token at all, so toggling visibility/activation and reordering are exploitable as pure CSRF without any token leak. Limiting factors: no exploitation is possible without an active admin session (the routes 302-redirect anonymous requests to /admin/login) and without victim interaction; affects Thelia before 3.2.0 and the listed companion template/module packages.

This is a genuine but moderate-priority issue, not a drop-everything emergency. The signals are internally consistent: the supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:L) yields 5.9 (medium), and the vuln.today decision label is 'this_month' rather than act_now or emergency. There is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis' in the packaged sense, though a detailed step-by-step PoC is published in the vendor GHSA advisory (see exploit_scenario). The practical risk is bounded by the attack preconditions: the victim must be a currently logged-in back-office administrator who performs user interaction (UI:A), and for the delete routes the attacker must separately obtain the per-session CSRF token that leaks via the URL (access logs, browser history, Referer, or XSS). Crucially, the advisory and patch show the setToggleVisibilityAction and updatePositionAction inherited from AbstractCrudController accepted no token at all, so those two are exploitable as pure CSRF with no token leak required. Impact is integrity/availability (unauthorized delete, hide, reorder of catalogue and configuration objects, plus storefront breakage from deleting defaults), with no confidentiality impact. Net: a real, fixable flaw worth patching on a normal cycle; the authenticated-admin-plus-interaction requirement and the niche deployment footprint keep it out of mass-exploitation territory.

An attacker hosts a page or email containing a crafted link (or auto-loading GET) to a Thelia back-office action and lures a logged-in administrator to click it; the PHPSESSID cookie rides the top-level GET navigation (SameSite=Lax), and the unprotected toggle/position actions execute with no token - while delete actions execute if the attacker has also obtained the URL-leaked per-session token. A detailed working PoC (including login-wall and token controls) is published in the vendor GHSA advisory, so defenders should treat the technique as public. Attack vector is network with low complexity but requires active admin interaction (UI:A).