{"id":"GHSA-g8pg-33v4-9r96","aliases":[],"status":"published","title":"Thelia authentication bypass vulnerability","description":"An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2024-05-30T13:26:47Z","modified":"2026-07-17T18:30:27Z","fixes":[{"ecosystem":"Packagist","package":"thelia/thelia","fixed_in":["2.1.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"thelia/thelia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta1"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"thelia/thelia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0-beta1"},{"fixed":"2.1.3"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-beta1","2.0.0-beta2","2.0.0-beta3","2.0.0-beta4","2.0.1","2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.3-beta","2.0.3-beta2","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-alpha1","2.1.0-alpha2","2.1.0-beta1","2.1.0-beta2","2.1.1","2.1.2"]}],"references":[{"url":"https://github.com/thelia/thelia/commit/028cfcf507cd8685772e156ec0c860034d407094","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/thelia/thelia/2015-04-13-1.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20160502224630/http://thelia.net/version-2-1-3-with-security-fix","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/8012","tags":["web"]},{"url":"https://github.com/thelia/thelia/commit/71c1cee66d8f2e515e82478f792879fa63843644","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g8pg-33v4-9r96"},{"url":"https://github.com/thelia/thelia","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g8pg-33v4-9r96","title":"Thelia authentication bypass vulnerability","description":"An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1.","status":"published","published":"2024-05-30T13:26:47Z","modified":"2026-07-17T18:14:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:40:46.257074Z"}],"osv":[{"id":"GHSA-g8pg-33v4-9r96","title":"Thelia authentication bypass vulnerability","description":"An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1.","status":"published","published":"2024-05-30T13:26:47Z","modified":"2026-07-17T18:30:27.884445483Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}