A cross‑site request forgery flaw in Thelia before 3.2.0 allows attackers to repeat or reuse per‑session CSRF tokens that are inadvertently exposed in URL query strings. The flaw also leaves the setToggleVisibilityAction and updatePositionAction unprotected, meaning an attacker who has obtained a leaking token or who can manipulate these URLs can delete, hide, or reorder catalog and configuration objects with administrative authority.

Affected products include Thelia Core and associated back‑office templates (Default Template, Default Twig Template) as well as the Smarty Module. Any installation running a version prior to 3.2.0 is vulnerable; the CWE listed for this issue is CWE‑352.

The CVSS score of 5.9 indicates moderate risk. The exploit probability (EPSS) is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires either a stolen or leaked CSRF token or an authenticated administrator session that can be tricked into visiting malicious URLs. Once the token is captured, the attacker can perform privileged administrative actions, compromising the integrity and availability of catalog data.