GHSA-g8pg-33v4-9r96 is a high-severity (CVSS 7.5) vulnerability in thelia/thelia. A fix is available for thelia/thelia — see the affected versions and patch details below.
Real-World Exposure
thelia/theliaReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
An authentication bypass was identifed in thelia/thelia project for customer and admin. This vulnerability is present from version 2.0.0-beta1 and is fixed in 2.1.3 and 2.2.0-alpha1.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | thelia/thelia | ≥ 2.0.0-beta1&&< 2.1.3 | 2.1.3composer require thelia/thelia:^2.1.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for thelia/thelia, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update thelia/thelia to 2.1.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g8pg-33v4-9r96 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-g8pg-33v4-9r96 in your dependencies?
Find it across Packagist, including transitive dependencies.