CVE-2026-120249
Received Received - Intake

Cross-Site Request Forgery in Thelia Back-office Default Twig Template

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulnCheck

Description
Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120249
EUVD
EUVD-2026-114746

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia Back-office Default Twig Template 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Thelia Back-office Default Twig Template versions before 1.1.1. The /admin/product/combinations/update and /admin/product/default-price/update routes accept GET requests without CSRF token checks. Attackers can trick a logged-in admin into clicking a malicious link, which modifies product prices, stock, weight, EAN codes, and sale flags. Omitted price fields are set to zero, potentially making products free.

Detection Guidance

Check if your Thelia back-office uses the default-twig template version before 1.1.1 by inspecting the template files or running composer show thelia/backoffice-default-twig-template. Verify if the vulnerable endpoints /admin/product/combinations/update and /admin/product/default-price/update accept GET requests by testing with curl or browser access.

Impact Analysis

If you are an administrator using Thelia Back-office Default Twig Template before 1.1.1, attackers can manipulate product data without your knowledge. They can change prices, stock levels, or other attributes, potentially causing financial loss or operational disruptions. Users may see incorrect product information or prices.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to product data, which may violate integrity requirements in GDPR (data accuracy) or HIPAA (secure handling of sensitive information). Unauthorized changes to product details could lead to regulatory violations if they affect data integrity or consumer rights.

Mitigation Strategies

Upgrade the default-twig template to version 1.1.1 or later. Ensure the vulnerable endpoints only accept POST requests and implement CSRF token validation. Review product data for unauthorized changes after applying fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart