CVE-2026-120206

The record

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

Affected packages

Related vulnerabilities

• CVE-2026-110288 A cross-site request forgery vulnerability was identified in GitHub Enterprise Server… CWE-352
• CVE-2026-63433 MyTube is a self-hosted downloader and player for several video websites. CWE-352
• CVE-2026-121451 AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in… CWE-352
• CVE-2026-103420 Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5… CWE-352
• CVE-2026-120249 Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request… CWE-352
• CVE-2026-120207 Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that… CWE-352
• CVE-2026-61826 Bazarr is a companion application to Sonarr and Radarr. CWE-352
• CVE-2026-65566 Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows… CWE-352