# CVE-2026-103523: Thelia open redirect in address creation workflow

Source: https://junglewise.ai/threats/cve-2026-103523-thelia-v2-6-0-contains-an-open-redirect-vulnerability-in-its  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-103523 · Severity: info · Published 2026-10-12

Thelia is an open-source e-commerce platform used to build online storefronts and manage product catalogs. This vulnerability in the address creation feature allows an attacker to craft a malicious link that redirects users to an attacker-controlled website after they submit the "Add New Address" form. Users who click such links could be phished or compromised without the knowledge of the legitimate store.

Technologies: [Thelia](https://junglewise.ai/threats/technologies/thelia). Vendors: [Thelia](https://junglewise.ai/threats/vendors/thelia).

## Quick answers

**Is CVE-2026-103523 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103523 being exploited in the wild.

**How severe is CVE-2026-103523?** Informational severity, published 12 October 2026.

**Which products and versions are affected?** Thelia 2.6.0.

**Is there a fix for CVE-2026-103523?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-103523 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103523?** Check whether you run Thelia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an open redirect in the address creation workflow caused by insufficient validation of the `next` parameter. After form submission, the application redirects to the URL specified in `next` without checking if it belongs to the same origin or an approved allowlist. An authenticated user accessing a crafted URL is required, and successful exploitation redirects the user to an attacker-controlled domain.

## Affected products

- Thelia Thelia 2.6.0

## Timeline

- 2026-10-12: disclosed

## References

- [https://kb.cert.org/vuls/id/162329](https://kb.cert.org/vuls/id/162329)

## Related threats

- [Thelia stored cross-site scripting in store media upload](https://junglewise.ai/threats/cve-2026-120248-thelia-before-3-1-1-contains-a-stored-cross-site-scripting)
- [Thelia CSRF vulnerability in back office administrative actions](https://junglewise.ai/threats/cve-2026-120206-thelia-before-3-2-0-contains-a-cross-site-request-forgery)
- [Thelia stored cross-site scripting in coupon condition summary](https://junglewise.ai/threats/cve-2026-120205-thelia-before-3-1-0-contains-a-stored-cross-site-scripting)
- [Thelia coupon usage limit bypass](https://junglewise.ai/threats/cve-2026-112285-thelia-before-3-1-5-and-3-2-x-before-3-2-4-contains-a-business)
- [Thelia unrestricted file upload via trailing space bypass](https://junglewise.ai/threats/cve-2026-109397-thelia-before-3-1-2-and-3-2-x-before-3-2-1-contains-an)