Auth bypass in TYPO3 Extension "Sgalinski Cookie Consent"

CVE-2026-112066

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

Vulnerability class: Broken Access Control

Published · last modified .

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

References