CVE-2026-103523

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the `next` parameter. Because the application does not validate whether the destination belongs to the same origin or an approved allowlist, an attacker can supply an arbitrary external URL and redirect users to an attacker-controlled website.

• CWE-601

• https://kb.cert.org/vuls/id/162329

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103514The WP 2FA WordPress plugin before 4.1.0 does not invalidat…7.5
• CVE-2026-103517The Airwallex Online Payments Gateway WordPress plugin befor…5.3
• CVE-2026-103519The The WP Ultimate Review plugin for WordPress is vulnerabl…5.4
• CVE-2026-103520The HivePress – Business Directory, Listings & Classified Ad…6.4
• CVE-2026-103521In Thelia v2.6.0, the document upload endpoint properly bloc…7.2
• CVE-2026-103522In Thelia v2.6.0, the store banner upload feature performs i…7.2
• CVE-2026-103524Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabi…
• CVE-2026-103526In Thelia v2.6.0, both the administrative login and forgotte…3.7
• CVE-2026-103527Thelia v2.6.0's Smarty templates (address.html and address-u…
• CVE-2026-103528Thelia 2.6.0 uses Smarty for email templates without properl…
• CVE-2026-103529Thelia v2.6.0 permits authenticated administrators to upload…
• CVE-2026-103530A vulnerability was detected in decolua 9Router up to 0.5.55…7.3