CVE-2026-112066High· 7.1▾ TwilightThe JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
sgalinski/sg-cookie-optin >= 8.0.0 < 8.1.12sgalinski/sg-cookie-optin < 7.4.6Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112065Medium· 5.3Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
CVE-2026-112064High· 7.1SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
CVE-2026-112069Medium· 6.3Broken Access Control in extension "FAL Protect" (fal_protect)
CVE-2026-112070Medium· 5.3Broken Access Control in extension "Analytics" (analytics)
CVE-2026-113468Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
CVE-2026-112239High· 7.2Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)