Thelia Back-office CVE-2026-120249

Requires a Thelia administrator to be logged in with an active back-office session in the same browser and to click (or be redirected via top-level navigation to) an attacker-crafted link to /admin/product/combinations/update or /admin/product/default-price/update; the routes accept GET and perform no anti-CSRF token validation in versions before 1.1.1 (default configuration). No attacker account or credentials are needed. Exploitation is LIMITED by: mandatory admin user interaction (a clicked link or auto-redirect/meta-refresh, not a background subresource), and the SameSite=Lax session cookie, which permits top-level GET navigations but refuses subresource requests such as <img src> or prefetchers that arrive without the session cookie. The only server-side gate is the victim's own UPDATE access check, which does not defend against CSRF.

This is a genuine but moderate-priority integrity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, score 6.9) shows a remotely reachable, low-complexity flaw needing no attacker credentials, but it is gated by active user interaction (UI:A): a logged-in administrator must click an attacker's link. Impact is confined to integrity (VI:H) with no confidentiality or availability loss (VC:N/VA:N) - consistent with CSRF rewriting catalogue data rather than yielding code execution or data theft. It is NOT in CISA KEV (no KEV signal in input) and no EPSS probability was supplied, so there is no evidence of active or widespread exploitation; the detailed reproduction in the GHSA advisory is a public PoC reference, not verified packaged exploit code. The vuln.today decision label is 'this_month', which aligns with the signals - patch promptly but this is not act_now/emergency. The main tension to flag: raw CVSS is driven high by AV:N/PR:N, yet real-world risk is tempered by the requirement that a specific privileged human (an admin) be logged in and be socially engineered into clicking, and by SameSite=Lax limiting the vector to top-level navigations. Net: a real, easily-weaponizable one-click CSRF worth patching this cycle, but exposure is bounded by admin interaction and the niche deployment base of the product.

An attacker hosts a web page containing a crafted link (or auto-redirect) to a Thelia back-office product route and lures a shop administrator who is logged in within the same browser. With one top-level click the browser issues an authenticated GET that the server accepts without any CSRF token, silently rewriting product combination prices, sale prices, stock, weight, EAN and sale flags - omitted price fields are written as 0, turning items into free products. A detailed public PoC reference exists in the GHSA advisory (reproduction steps for both routes); it is not verified as packaged working exploit code.