AI analysis
Thelia v2.6.0, an open-source PHP e-commerce platform, returns different responses for invalid usernames versus incorrect passwords on its administrative login and forgotten-password endpoints. An unauthenticated remote attacker can probe these endpoints to reliably enumerate valid administrator account names. The lack of rate limiting or lockout protections means this enumeration can be performed at scale and efficiently. The impact is limited to information disclosure of account existence, which can then be leveraged for targeted brute-force or phishing attacks. No public proof of concept or active exploitation is known, and CISA has not listed it in the KEV.
What to do: Upgrade to a patched Thelia release (2.6.1 was also affected per CERT coordination; check the vendor advisory for the fixed version). In the interim, place the admin and password-reset endpoints behind rate limiting (e.g., web application firewall rules or fail2ban) and return generic error messages regardless of whether the username or password is wrong. Review admin authentication logs for anomalous enumeration-style probing.
Estimated exposure
nichelikely low thousands of deployments at most — Thelia is a self-hosted, French-origin open-source e-commerce CMS with a modest user base compared to mainstream platforms, so public-facing installations are plausibly in the hundreds to low thousands.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protections against repeated authentication attempts, username enumeration can be performed efficiently at scale.