The vulnerability resides in the Thelia Back‑office Default Twig Template and allows attackers to perform cross‑site request forgery on the /admin/product/combinations/update and /admin/product/default-price/update routes. These routes accept GET requests without anti‑CSRF token checks. By luring a logged‑in administrator to a crafted link, an attacker can rewrite the prices, stock quantities, weight, EAN, and sale flags of product combinations, and cause omitted prices to be set to zero. This leads to untrusted alteration of critical product attributes, potentially causing financial loss or inventory inaccuracies.

The flaw affects Thelia Back‑office Default Twig Template versions before 1.1.1. No other vendor or product versions are listed in the advisory.

The CVSS score of 6.9 classifies the flaw as high‑moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The likely attack vector is web‑based and requires an authenticated administrator session to be tricked into visiting a malicious URL. While exploitation is plausible, the lack of current exploitation data suggests the risk is noteworthy but not critical.