CVE-2026-112066 — Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

CVE-2026-112066

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin) PUBLISHED

Description (CNA)

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

Affected (CNA)

Vendor / product	Versions
TYPO3 / Extension "sgalinski Cookie Consent"	affected 8.0.0 before 8.1.12; affected 0 before 7.4.6

CWE

CWE-862

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-029

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.