Vulnerability · Published Nov 1, 2026 · Assigned by VulnCheck

CVE-2026-120249Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

Medium 6.5

In plain English

A medium-severity cross-site request forgery in Thelia Back-office Default Twig Template from Thelia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

Affected products (as reported)

Vendor	Product	Versions
Thelia	Thelia Back-office Default Twig Template	0 – before 1.1.1

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-j2c3-9c4q-c2ch) vendor-advisory, third-party-advisory
https://github.com/thelia-templates/default-twig/commit/aaf540ca552dbc4c63dca77620af4b7936d22e8f patch
https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093aa58a3064d4412bd3 patch
https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Catalog/ProductAdvancedController.php#L546-L599 technical-description
VulnCheck Advisory: Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes third-party-advisory