CVE-2026-120207
Received Received - Intake

Cross-Site Request Forgery in Thelia Page Module

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: VulnCheck

Description
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-120207
EUVD
EUVD-2026-114728

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia Page Module 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120207 is a cross-site request forgery (CSRF) vulnerability in Thelia Page Module versions before 2.0.4. It allows remote attackers to delete page tags, documents, and images by exploiting back-office delete routes that lack CSRF tokens and permission checks. Attackers can trick a logged-in administrator into visiting a malicious GET request with sequential IDs, which removes TheliaLibrary images, their files, and variants across pages, products, and categories.

The vulnerability stems from untokenized GET requests for deletion endpoints, enabling unauthorized write actions without proper validation.

Detection Guidance

Check Thelia Page Module version with: grep -r 'Page' /path/to/thelia/modules/Page/composer.json. If version is below 2.0.4, the system is vulnerable. Monitor admin logs for unexpected deletions of images, tags, or documents.

Impact Analysis

This vulnerability can lead to unauthorized deletion of critical assets such as images, documents, and tags. For administrators, it means potential loss of data, including shared media library images used across products and categories. The impact includes irreversible destruction of database rows and physical files, disrupting website functionality and content integrity.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized data deletion or modification. GDPR requires data integrity and protection, while HIPAA mandates secure handling of sensitive information. Unauthorized deletions may lead to data breaches, loss of audit trails, and failure to meet regulatory requirements for data availability and security.

Mitigation Strategies

Upgrade Thelia Page Module to version 2.0.4 or later immediately. Ensure all admin write operations use POST requests with CSRF tokens. Review and restrict admin access rights to prevent unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart