CVE-2026-103523

Executive Summary

CVE-2026-103523 is an open redirect vulnerability affecting Thelia v2.6.0, an open-source e-commerce platform. The flaw resides in the address creation workflow, where the application fails to validate the destination URL supplied via the next parameter, allowing attackers to redirect users to arbitrary external sites after they submit the "Add New Address" form. While this vulnerability does not directly compromise confidentiality or integrity of the application itself, it enables phishing, credential harvesting, and malware delivery campaigns by abusing the trusted domain of the affected Thelia instance.

Technical Analysis

The vulnerability is classified as an open redirect (CWE-601). In Thelia v2.6.0, the address creation workflow accepts a next parameter that specifies the URL to which the user should be redirected after successfully submitting the "Add New Address" form. The application does not validate whether this destination belongs to the same origin or an approved allowlist, meaning an attacker can supply any arbitrary external URL. When a victim accesses a crafted URL containing the malicious next value and completes the form submission, the application issues an HTTP redirect to the attacker-controlled destination. The core weakness is the absence of origin validation on a user-controllable redirect parameter. Because the redirect originates from the legitimate Thelia application, users are more likely to trust the destination, making this an effective vector for social engineering and credential theft. No public proof-of-concept, exploit code, or Nuclei template is available, and the vulnerability remains unpatched per all tracked sources. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) reflects network exploitability, low attack complexity, no privileges required, and required user interaction. The scope change (S:C) indicates the vulnerable component impacts resources beyond its security scope — specifically, the attacker-controlled external site. Confidentiality impact is low (C:L) as the redirect itself does not expose data, while integrity and availability impacts are none.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (open redirect) and the NVD description.

1. Reconnaissance/target identification: The attacker identifies a publicly accessible Thelia v2.6.0 instance, typically an e-commerce storefront. The address creation workflow is generally accessible to authenticated users or, in some configurations, to guest users during checkout.

2. Triggering the flaw class: The attacker crafts a URL pointing to the address creation form and appends a next parameter containing an arbitrary external URL (e.g., https://thelia-store.example/address/create?next=https://attacker-controlled.example/phish). The absence of origin validation on this parameter is the root cause.

3. Payload/execution method: The attacker distributes the crafted URL via phishing email, social media, or malicious advertisements. When the victim accesses the URL, they are presented with a legitimate Thelia "Add New Address" form. After successfully submitting the form, the application processes the next parameter and issues an HTTP redirect to the attacker-supplied URL. The victim's browser navigates to the attacker-controlled website, which may impersonate a login page or deliver malware.

4. Post-exploitation impact: The attacker can harvest credentials if the destination mimics a trusted login portal, distribute malware, or conduct further social engineering. Because the redirect originates from the legitimate Thelia domain, users and automated security controls may trust the destination, increasing the likelihood of successful compromise. The scope change in the CVSS vector reflects that the impact extends to the external site, not the Thelia application itself.

Impact Assessment

The primary impact is abuse of user trust in the Thelia domain to facilitate phishing and malware distribution. The CVSS vector indicates low confidentiality impact and no integrity or availability impact on the vulnerable application, but the scope change (S:C) means the attacker-controlled external site is impacted. Business impact includes reputational damage to the Thelia store operator, potential loss of customer trust, and legal/regulatory exposure if customer credentials are harvested. The blast radius is limited to users who interact with the crafted URL and complete the address creation form. Affected systems are any publicly accessible Thelia v2.6.0 deployment with the address creation workflow enabled. No CVSS score is assigned by NVD (N/A), and EPSS is not yet scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Thelia v2.6.0 Open Redirect via next Parameter
id: 7a3c9e2f-1b4d-4e8a-9f2c-6d5e8a1b3c7d
status: experimental
description: Detects HTTP requests containing the next parameter with an external URL in Thelia address creation workflow
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: http
detection:
  selection_uri:
    cs-uri-query|contains: "next="
    cs-uri-stem|contains: "/address"
  selection_external:
    cs-uri-query|re: "next=https?://(?!.*(thelia|localhost|127\\.0\\.0\\.1))"
  condition: selection_uri and selection_external
falsepositives:
  - Legitimate external redirects configured by administrators
level: medium
tags:
  - attack.t1190
  - cwe.601

YARA Rule

rule CVE_2026_103523_Thelia_Open_Redirect
{
    meta:
        description = "Detects Thelia v2.6.0 open redirect exploitation attempts in HTTP traffic or logs"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-103523"
        severity = "medium"
    strings:
        $next_param = "next=" ascii wide nocase
        $addr_path = "/address" ascii wide nocase
        $http_ext = "http://" ascii wide nocase
        $https_ext = "https://" ascii wide nocase
    condition:
        ($next_param and $addr_path) and ($http_ext or $https_ext)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103523 Thelia Open Redirect Attempt via next Parameter"; flow:to_server,established; http.uri; content:"/address"; http.uri; content:"next="; http.uri; pcre:"/next=https?:\/\/(?!(?:[^\/]*\.)?(?:thelia|localhost|127\.0\.0\.1))/i"; classtype:web-application-attack; sid:2026103523; rev:1; reference:cve,2026-103523; metadata:mitre_tactic "Initial Access", mitre_technique "T1190";)

Elastic Detection

sequence by user.name with maxspan=10m
  [ network where url.path : "/address*" and url.query : "*next=*" ]
  [ network where url.query : "*next=http*" and not url.query : "*next=http*thelia*" and not url.query : "*next=http*localhost*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(uri, "/address")
| where match(uri, "next=")
| rex field=uri "next=(?<next_url>https?://[^\s&]+)"
| where NOT match(next_url, "(?i)thelia|localhost|127\.0\.0\.1")
| stats count by src_ip, uri, next_url, status, useragent
| sort - count
| table src_ip, uri, next_url, status, useragent, count

Wazuh OSSEC Rule

<group name="web,thelia,open_redirect,">
  <rule id="100523" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/address</field>
    <field name="url">next=</field>
    <regex type="pcre2">next=https?:\/\/(?!(?:[^\/]*\.)?(?:thelia|localhost|127\.0\.0\.1))</regex>
    <description>CVE-2026-103523: Thelia open redirect attempt detected via next parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Validate and restrict the next parameter to same-origin URLs or an approved allowlist. Reject or sanitize any value containing an external domain, protocol-relative URL (//), or encoded scheme.
   • Implement a redirect confirmation page that displays the destination URL and requires explicit user consent before proceeding.
   • Deploy Web Application Firewall (WAF) rules to inspect requests to the address creation endpoint for external URLs in the next parameter.
   • Disable or restrict the address creation workflow for unauthenticated users if not operationally required.

2. Patch/upgrade steps:

   • No official patch is available. Monitor Thelia's official repository and security advisories for updates addressing CVE-2026-103523.
   • If a patched version becomes available, upgrade from v2.6.0 to the latest stable release after testing in a staging environment.
   • Apply virtual patching via WAF or reverse proxy rules until a vendor fix is released.

3. Long-term hardening:

   • Adopt a secure coding policy that mandates allowlist validation for all user-controllable redirect parameters.
   • Conduct regular security assessments and penetration testing of e-commerce workflows, particularly those involving user-supplied redirects.
   • Implement Content Security Policy (CSP) headers to restrict navigation to trusted origins.
   • Educate users about phishing risks and the potential for trusted domains to be abused in open redirect attacks.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103523
• Thelia Official Website: https://thelia.net/
• CWE-601: URL Redirection to Untrusted Site ('Open Redirect'): https://cwe.mitre.org/data/definitions/601.html
• OWASP Unvalidated Redirects and Forwards Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE at this time. The vulnerability remains unpatched, and no public PoC or exploit code is available.