What’s Vulnerable › Vulnerabilities
CVE-2026-112065: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
- Severity: medium (CVSS 5.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-20 · updated 2026-10-20
- Weakness: CWE-862
Description
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
Affected products
- TYPO3 Extension "sgalinski Cookie Consent": from 8.0.0 before 8.1.12; before 7.4.6 — fixed in 7.4.6, 8.1.12
How to fix
Upgrade to a fixed version: TYPO3 Extension "sgalinski Cookie Consent" 7.4.6, 8.1.12. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-112065 or the next vulnerability affects your stack