CVE-2026-103523
Received Received - Intake

Open Redirect Vulnerability in Thelia v2.6.0

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: CERT/CC

Description
Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-103523
EUVD
EUVD-2026-97476

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Thelia Thelia 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Thelia v2.6.0 has an open redirect vulnerability in its address creation workflow. When a user visits a specially crafted URL and submits the 'Add New Address' form, the application redirects them to a URL specified in the 'next' parameter. The application fails to validate if the destination URL is from the same origin or an approved list, allowing attackers to redirect users to malicious external sites.

Detection Guidance

To detect this open redirect vulnerability in Thelia v2.6.0, monitor HTTP requests for the 'next' parameter in address creation workflows. Check for URLs redirecting to external domains not belonging to your site. Inspect server logs for unusual redirect patterns or user reports of unexpected redirects.

Impact Analysis

This vulnerability can be exploited by attackers to trick users into visiting malicious websites. Users may unknowingly enter sensitive information on fake pages or download malware. It can also be used in phishing attacks to steal credentials or spread malware.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or penalties for failing to protect user data from such attacks.

Mitigation Strategies

Immediately update Thelia to the latest version to patch this vulnerability. If an update is unavailable, implement server-side validation to ensure the 'next' parameter only accepts URLs from the same origin or a predefined allowlist. Add strict input validation and output encoding for the redirect URL.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart