CVE-2026-120249

    Dashboard / Vulnerabilities / CVE-2026-120249

    CVE-2026-120249

    Published: 1 Nov 2026Last Modified: 2 Nov 2026

    Summary: Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

    Details: Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attackers can lure a logged-in administrator into following a crafted link to rewrite product combination prices, stock, weight, EAN and sale flags, zeroing omitted prices.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120249.json, https://github.com/thelia/thelia/security/advisories/GHSA-j2c3-9c4q-c2ch, https://nvd.nist.gov/vuln/detail/CVE-2026-120249, https://www.vulncheck.com/advisories/thelia-back-office-default-twig-template-before-1.1.1-csrf-via-product-combination-routes, https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093aa58a3064d4412bd3, https://github.com/thelia-templates/default-twig/commit/aaf540ca552dbc4c63dca77620af4b7936d22e8f, https://github.com/thelia-templates/default-twig, https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Catalog/ProductAdvancedController.php#L546-L599

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -36ae820401ab5b83994dd0f398f57b7ced3b1d73

    Affected versions

    1.1.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High