CVE-2026-120206 | Thelia up to 3.1.x Back Office setToggleVisibilityAction/updatePositionAction cross-site request forgery (EUVD-2026-114727)

October 31, 2026 Yanac

A vulnerability has been found in Thelia up to 3.1.x and classified as problematic. The impacted element is the function setToggleVisibilityAction/updatePositionAction of the component Back Office. Performing a manipulation results in cross-site request forgery.

This vulnerability is cataloged as CVE-2026-120206. It is possible to initiate the attack remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More