EUVD-2026-97476
GHSA-2rgp-5p5r-5w94
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with malicious next parameter
-
DeliveryDeliver trusted-looking link via phishing
-
ExploitVictim submits Add New Address form
-
ExecutionApplication redirects to attacker-controlled site
-
ImpactCredential theft or malware delivery
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Redirect URL validation
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim (1) opens an attacker-crafted URL targeting Thelia's address-creation endpoint with a malicious absolute URL in the 'next' parameter, and (2) actually submits the 'Add New Address' form - the redirect only fires on successful form submission, so the UI:R requirement is a real limiter. The root condition is that Thelia 2.6.0 does not validate the 'next' destination against the same origin or an allowlist. No authentication bypass is needed beyond normal user session, but the dependence on both user interaction and form completion, combined with no server-side impact, meaningfully constrains realistic abuse to social-engineering/phishing contexts. |
| Impact | This is a genuine-but-low-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction (UI:R) - the victim must click a crafted URL and submit the 'Add New Address' form - which substantially limits reliability. The scope change (S:C) and C:L/I:L impacts reflect the fact that the damage lands outside the vulnerable application (on the user, via the attacker-controlled destination) rather than on Thelia itself; an open redirect (CWE-601) grants no code execution, data read, or data modification on the server. EPSS reinforces the low-urgency reading: 0.18% probability at the 7th percentile indicates very low expected exploitation volume. There is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record is provided in the input. Signals are consistent (low EPSS, no KEV, no POC, medium CVSS driven largely by scope rather than impact), so this is a high-CVSS-category-but-low-real-risk issue best handled via routine patching, chiefly valuable to attackers as a credibility booster for phishing campaigns. |
| Exploit ScenarioDerived | An attacker crafts a Thelia address-creation URL embedding a malicious external value in the 'next' parameter and delivers it via phishing. A logged-in shopper clicks the trusted Thelia link, submits the 'Add New Address' form, and is silently redirected to an attacker-controlled site that spoofs Thelia to harvest credentials or deliver malware. No public exploit code is referenced, but the technique is trivial and requires only that the victim complete the form submission. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
An open redirect in Thelia's address-creation workflow (versions up to and including 2.6.0) lets an attacker craft a URL that carries an arbitrary external destination in the 'next' parameter; once the victim completes the 'Add New Address' form, the application redirects them to that attacker-controlled site. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to both open the crafted link and successfully submit the form (UI:R), and it produces no server-side compromise - impact is limited to confidentiality and integrity at low severity with changed scope. EPSS is only 0.18% (7th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
No vendor-released patch was identified at time of analysis, so remediation is currently configuration- and control-based rather than upgrade-based; administrators should watch the CERT/CC note at https://kb.cert.org/vuls/id/162329 and the CVE record at https://nvd.nist.gov/vuln/detail/CVE-2026-103523 for a fixed Thelia release and apply it as soon as it is published. In the interim, the single most effective fix is to enforce server-side validation of the 'next' parameter so it accepts only same-origin relative paths or values matching a strict allowlist, which can be done by patching the address-creation controller directly in the Thelia template/plugin code; the trade-off is that custom or third-party modules relying on absolute post-submission destinations will need those URLs added to the allowlist or they will break. Fronting the site with a WAF or reverse-proxy rule that rejects requests whose 'next' parameter contains a scheme (http:, https:, //) or an off-site host reduces automated abuse but can be bypassed with encoded variants and may need tuning to avoid blocking legitimate links. If immediate code changes are not feasible, consider disabling or de-emphasizing the post-registration redirect entirely (returning users to a fixed local page) and adding user-facing warnings plus link-inspection on outbound email campaigns, accepting the loss of the intended convenient redirect behavior. Because the attack depends on the victim submitting the address form, phishing-awareness measures and mail-gateway scanning for Thelia address-creation URLs containing external 'next' values are useful compensating controls, though they do not remove the underlying flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-601, URL Redirection to Untrusted Site ('Open Redirect'), in the Thelia e-commerce/CMS address management component. The address creation flow accepts a 'next' parameter that is intended to hold the post-submission return destination, but Thelia 2.6.0 fails to verify that this value is same-origin or a member of an approved allowlist, so an absolute external URL supplied by an attacker is honored verbatim in the resulting HTTP redirect. The CVSS scope-changed (S:C) rating reflects that the redirect moves the user out of the vulnerable Thelia origin into a third-party origin, which is what makes the bug useful as a phishing/credential-harvesting pivot rather than a direct server compromise. The supplied CPE cpe:2.3:a:thelia:thelia:*:*:*:*:*:*:*:* is a wildcard across all Thelia releases, and the ENISA EUVD record describes the affected range as Thelia versions up to and including 2.6.0, so installations on the 2.x line should be treated as potentially exposed until a fixed release is confirmed.
Know when Thelia gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable and low-complexity with no auth (PR:N) but mandatory victim form submission (UI:R); scope changes (S:C) as harm lands on the redirected user, with only low confidentiality/integrity effect and no availability impact.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
2DescriptionCVE.org
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Authenticated back-office users of Thelia through 2.6.1 can chain a path traversal flaw in the translation editor with a
Server-side template injection in the back-office Email/Messages feature of Thelia 3.0.0 lets an authenticated user hold
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an aut
Remote code execution in Thelia v2.6.0 is achievable by an authenticated administrator who abuses the document update en
Authenticated attackers holding a Thelia administrator account can achieve remote code execution on the underlying serve
Reflected cross-site scripting in Thelia versions up to 2.6.0 allows remote attackers to execute arbitrary JavaScript in
Authenticated administrators of Thelia 2.6.0 and earlier can achieve remote code execution by injecting malicious Smarty
Authenticated template injection in Thelia versions up to and including 2.6.1 lets a logged-in user with access to Smart
Remote code execution in Thelia 2.6.0 and earlier is achievable by an authenticated back-office administrator who uses t
Stored cross-site scripting in Thelia (all versions from 0 through 2.6.0) lets an authenticated back-office user - speci
Username enumeration in Thelia 2.6.0 lets unauthenticated remote attackers determine which administrator accounts exist
CSV formula injection in Thelia (before 3.1.2 and 3.2.0 through 3.2.0, fixed in 3.2.1) lets unauthenticated visitors pla
Exploit-DB