Live › vulnerability › CVE-2026-112064
Go to dashboardThe backend module that shows consent history passes sorting, grouping and index request options into a database query without validation, and only the filter values are parameterized. A logged-in backend user with access to the history or statistics pages can read arbitrary database data, including password hashes of backend and frontend users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
TYPO3 sites with the third-party extension sgalinski Cookie Consent (sg_cookie_optin) installed at 7.4.5 or lower, or 8.0.0 to 8.1.11. The attacker needs a backend login with access to the consent history or statistics functions, then can read any database data including backend and frontend user password hashes. Sites without this extension, or on 7.4.6 / 8.1.12 or later, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sgalinski/sg-cookie-optin | packagist | <= 7.4.5, >= 8.0.0, <= 8.1.11 | 7.4.6, 8.1.12 |
composer show sgalinski/sg-cookie-optin (or check the Extension Manager) for the installed version; exposed if <= 7.4.5 or 8.0.0-8.1.11Update sgalinski/sg-cookie-optin to 7.4.6 (7.x line) or 8.1.12 (8.x line) via composer, extension manager, or extensions.typo3.org.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
This page as .md · .json · in your agent: get_signal("CVE-2026-112064")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.