CVE-2026-120206
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative act
CVSS
5.9
Média
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 31 de out. de 2026 · Última mod.: 5 de nov. de 2026 · CWE-352
0.1%EPSS · 30 dias0.1%
2026-11-012026-11-07
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.
- github.comhttps://github.com/thelia-templates/default-twig/commit/a9647682572de056ba258a2d4d53e42f5b591b84
- github.comhttps://github.com/thelia/thelia/blob/3.1.6/core/lib/Thelia/Controller/Admin/AbstractCrudController.php#L466
- github.comhttps://github.com/thelia/thelia/commit/55a7156e552d0b8145309b10175d13ecc1187433
- github.comhttps://github.com/thelia/thelia/releases/tag/3.2.0
- github.comhttps://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp
- www.vulncheck.comhttps://www.vulncheck.com/advisories/thelia-before-3.2.0-back-office-csrf-via-url-token-and-unprotected-actions
- github.comhttps://github.com/thelia/thelia/security/advisories/GHSA-cfvv-2jvw-x2hp
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1235457.1 ALT—
———OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user.6hCVE-2026-1234954.6 MÉD—
———Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the victim into the attacker's account and exposing data the victim then adds.6hCVE-2026-1234943.5 BAI—
———Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links.6hCVE-2026-1217836.5 MÉD—
——0Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90.13hCVE-2026-1217628.8 ALT10.0%
——3Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.18.0.13hCVE-2026-1194846.3 MÉD1.9%
——1Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Photo Gallery by Supsystic gallery-by-supsystic allows Cross Site Request Forgery.This issue affects Photo Gallery by Supsystic: from n/a through 1.21.6.13h