CVE-2026-112065 — Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

CVE-2026-112065

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) PUBLISHED

Description (CNA)

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "sgalinski Cookie Consent"	affected 8.0.0 before 8.1.12; affected 0 before 7.4.6

CWE

CWE-862

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-029

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.