{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/page-module--2.0.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:thelia:page_module:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-120207"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Page Module (\u003c 2.0.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Thelia"],"content_html":"\u003cp\u003eThelia Page Module versions prior to 2.0.4 contain a cross-site request forgery (CSRF) vulnerability in back-office delete routes. The vulnerability stems from a lack of CSRF tokens and insufficient permission checks, allowing an attacker to craft malicious GET requests that, when visited by a logged-in administrator, result in the deletion of site content. Attackers can leverage this to delete page tags, documents, and TheliaLibrary assets by iterating through sequential IDs.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the unauthorized deletion of site images, documents, and page tags across pages, products, and categories. This can result in significant loss of site content and broken site functionality.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the Thelia Page Module to version 2.0.4 or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement administrative session monitoring to identify anomalous administrative activity following periods of suspected phishing or social engineering.\u003c/li\u003e\n\u003cli\u003eEnsure that administrative access to the Thelia back-office is restricted to trusted networks and protected by robust authentication controls to minimize exposure to CSRF triggers.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-31T20:04:52Z","date_published":"2026-10-31T20:04:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-thelia-csrf/","summary":"The Thelia Page Module before 2.0.4 is vulnerable to CSRF, allowing an attacker to trick a logged-in administrator into triggering unauthorized deletions of tags, documents, and images.","title":"Thelia Page Module: Cross-Site Request Forgery (CVE-2026-120207)","url":"https://feed.craftedsignal.io/briefs/2026-10-thelia-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Page Module (\u003c 2.0.4)","version":"https://jsonfeed.org/version/1.1"}