Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-112066

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "sgalinski Cookie Consent"

Default version status: unaffected

  • 8.0.0 to < 8.1.12affected
  • 0 to < 7.4.6affected

References