Threats tagged 'ghsa-j499-8gjf-h2jf'

Thelia Back-office Default Twig Template versions before 1.1.1 have a cross-site request forgery (CSRF) vulnerability affecting specific admin routes that accept GET requests without anti-CSRF token validation. This flaw allows an attacker to trick a logged-in administrator into executing unauthorized actions that modify product combination details such as prices, stock, weight, EAN, and sale flags, potentially zeroing omitted prices.