Is CVE-2026-120249 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120249 being exploited in the wild.

How severe is CVE-2026-120249?

Medium severity, with a CVSS score of 6.5, published 1 November 2026.

Which products and versions are affected?

Thelia Back-office Default Twig Template before 1.1.1.

Is there a fix for CVE-2026-120249?

Yes: fixed in 1.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120249 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-120249?

Check whether you run Thelia Back-office Default Twig Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120249: Thelia Back-office Default Twig Template cross-site request forgery

CVE-2026-120249 · Severity: medium · CVSS 6.5 · Published 2026-11-01

Thelia's back-office template system allows administrators to manage product combinations and pricing. An attacker can craft a malicious link that, when clicked by a logged-in admin, silently modifies product prices, stock levels, weights, and other sale flags—potentially causing inventory errors or revenue loss without the admin's knowledge.

Vendors: Thelia.

Quick answers

Is CVE-2026-120249 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120249 being exploited in the wild.
How severe is CVE-2026-120249?: Medium severity, with a CVSS score of 6.5, published 1 November 2026.
Which products and versions are affected?: Thelia Back-office Default Twig Template before 1.1.1.
Is there a fix for CVE-2026-120249?: Yes: fixed in 1.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120249 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-120249?: Check whether you run Thelia Back-office Default Twig Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.1.1

Technical details

The vulnerability is a cross-site request forgery (CSRF) in the product combination and default price update endpoints (/admin/product/combinations/update and /admin/product/default-price/update), which accept GET requests without verifying anti-CSRF tokens. An authenticated administrator must visit a malicious link to trigger the attack; the attacker gains the ability to rewrite product attributes including prices, stock, weight, EAN codes, and sale flags.

Affected products

Thelia Back-office Default Twig Template before 1.1.1

Timeline

2026-11-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.