CVE-2026-49977 Details
Description
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.
An improper access control vulnerability has been identified in tarteaucitron.js, a cookie management library. Prior to version 1.33.0, the function tarteaucitron.cookie.purge() was applied to all elements with the purgeBtn class, without verifying if they were genuine tarteaucitron buttons or if the associated cookie belonged to a service managed by tarteaucitron. This oversight allowed attackers to create elements that, when clicked, could silently remove non-HttpOnly cookies with known names. The vulnerability required user interaction to exploit.
Users should upgrade to tarteaucitron.js version 1.33.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.drupal.org/sa-contrib-2026-040 | CVE | AdvisoryRemedyVendor |
| https://github.com/AmauriC/tarteaucitron.js/commit/24b5464400ae2ff1ad96a092c629b9d632b9cc93 | [email protected] | Source CodeVendor |
| https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.33.0 | [email protected] | Release NotesVendor |
| https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AmauriC tarteaucitron.js | < 1.33.0 (semver) |
CPE
Remediation
| |
| Drupal TacJS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |
| Jul 17, 2026 | CVE Modified | CVE |