Threats affecting pkg:github/thelia-templates/default-twig

Thelia Back-office Default Twig Template versions before 1.1.1 have a cross-site request forgery (CSRF) vulnerability affecting specific admin routes that accept GET requests without anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into executing unauthorized actions that modify product combination details such as prices, stock, weight, EAN, and sale flags, potentially zeroing omitted prices.