# CVE-2026-120249: Thelia Back-office Default Twig Template cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-120249-thelia-back-office-default-twig-template-before-1-1-1-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120249 · Severity: medium · CVSS 6.5 · Published 2026-11-01

Thelia's back-office template system allows administrators to manage product combinations and pricing. An attacker can craft a malicious link that, when clicked by a logged-in admin, silently modifies product prices, stock levels, weights, and other sale flags—potentially causing inventory errors or revenue loss without the admin's knowledge.

Vendors: [Thelia](https://junglewise.ai/threats/vendors/thelia).

## Quick answers

**Is CVE-2026-120249 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120249 being exploited in the wild.

**How severe is CVE-2026-120249?** Medium severity, with a CVSS score of 6.5, published 1 November 2026.

**Which products and versions are affected?** Thelia Back-office Default Twig Template before 1.1.1.

**Is there a fix for CVE-2026-120249?** Yes: fixed in 1.1.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120249 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120249?** Check whether you run Thelia Back-office Default Twig Template at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.1

## Technical details

The vulnerability is a cross-site request forgery (CSRF) in the product combination and default price update endpoints (/admin/product/combinations/update and /admin/product/default-price/update), which accept GET requests without verifying anti-CSRF tokens. An authenticated administrator must visit a malicious link to trigger the attack; the attacker gains the ability to rewrite product attributes including prices, stock, weight, EAN codes, and sale flags.

## Affected products

- Thelia Back-office Default Twig Template before 1.1.1

## Timeline

- 2026-11-01: disclosed

## References

- [https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Catalog/ProductAdvancedController.php](https://github.com/thelia-templates/default-twig/blob/6473c164bd86348f4c7d0ef6f194f1ff3d267902/src/Controller/Catalog/ProductAdvancedController.php)
- [https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093aa58a3064d4412bd3](https://github.com/thelia-templates/default-twig/commit/51b014b06a5b4ee45f15093aa58a3064d4412bd3)