CVE-2026-112065: medium-severity vulnerability in TYPO3 Extension "sgalinski Cookie Consent"
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "sgalinski Cookie Consent"Related CVEs — TYPO3 Extension "sgalinski Cookie Consent"
In the same product, most dangerous first.