CVE-2026-112066 Details
Description
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
A vulnerability exists in the 'sgalinski Cookie Consent' TYPO3 extension, specifically in versions 7.4.5 and below, as well as 8.0.0 to 8.1.11. The issue arises from the JSON import feature of the cookie consent configuration, which fails to adhere to the permissions of backend users. Non-admin users with access to the module can import configurations that add arbitrary scripts to the frontend of the website.
Users are advised to update to version 7.4.6 or 8.1.12, available through the TYPO3 extension manager, Packagist, or from the TYPO3 extensions website.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-029 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| sgalinski Cookie Consent | <= 7.4.5 (semver) >= 8.0.0, <= 8.1.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |