---
id: CVE-2026-103904
title: |-
  The public consent endpoint of JTL-Shop accepts arbitrary
  consent names from unauthenticated visitors without validating
  them against the configured consent items
summary: >-
  The public consent endpoint of JTL-Shop accepts arbitrary

  consent names from unauthenticated visitors without validating

  them against the configured consent items. These names are stored in the
  consent

  statistics and rendered without out…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T11:16:58.903'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103904'
references:
  - url: 'https://www.jtl-software.com/de/security/sicherheitsluecke-shop-xss/'
    label: a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
tags:
  - nvd
ingestedAt: '2026-10-14T11:27:22.142Z'
---

## Overview

The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are stored in the consent
statistics and rendered without output encoding in the administration
backend. An unauthenticated remote attacker can thereby inject script code that
is executed in the browser session of an administrator viewing the consent
statistics page, allowing actions to be performed with the administrator's
privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.