CVE-2026-120207 — Vulnerability intelligence
Thelia — Thelia Page Module
Published:
- CVSS
- 7
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a logged-in administrator into navigating to crafted GET requests that walk sequential ids, removing TheliaLibrary images, their files and variants across pages, products and categories.