{"id":"CVE-2026-112064","kind":"vulnerability","aliases":["CVE-2026-112064"],"related":[],"title":"TYPO3 consent history module: SQL injection leaks user password hashes","description":"The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.","summary":"The backend module that shows consent history passes sorting, grouping and index request options into a database query without validation, and only the filter values are parameterized. A logged-in backend user with access to the history or statistics pages can read arbitrary database data, including password hashes of backend and frontend users.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sgalinski/sg-cookie-optin","fixed":["7.4.6","8.1.12"],"affected":"<= 7.4.5, >= 8.0.0, <= 8.1.11","ecosystem":"packagist"}],"ecosystems":[],"tags":["backend-users","composer","database","other","sg_cookie_optin","sql-injection","typo3","typo3-extension"],"not_affected_if":["extension-not-installed","no-backend-access-for-untrusted-users","no-untrusted-backend-users"],"how_to_check":"Run 'composer show sgalinski/sg-cookie-optin' (or check the Extension Manager) for the installed version; exposed if <= 7.4.5 or 8.0.0-8.1.11. Also check which backend users can reach the consent history/statistics module.","fix":"Update sgalinski/sg-cookie-optin to 7.4.6 (7.x line) or 8.1.12 (8.x line) via composer, extension manager, or extensions.typo3.org.","status":"open","published_at":"2026-10-20T10:17:03+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:46+00:00","updated_at":"2026-10-25T03:36:56+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-25T03:34:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TYPO3 consent history module: SQL injection leaks user password hashes","impact":"high","summary":"The backend module that shows consent history passes sorting, grouping and index request options into a database query without validation, and only the filter values are parameterized. A logged-in backend user with access to the history or statistics pages can read arbitrary database data, including password hashes of backend and frontend users.","category":"other","nicknames":[],"who_cares":["backend-users","database"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker reads database contents including user password hashes.","analyst_note":"Identify the affected product, versions and fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-112064); the description suggests a TYPO3 extension but this is not stated in the sources.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-backend-access-for-untrusted-users"],"who_is_affected":"Only sites where backend users can reach the consent history or statistics functions are exposed, so the attacker needs a backend account first. Sites that do not use this consent history module, or that restrict backend access to trusted editors, face lower risk. The sources do not name the affected product or versions, so the team should confirm which package provides this module.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000577,"input_tokens":3312,"output_tokens":492,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product, versions and fixed release from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-112064); the description suggests a TYPO3 extension but this is not stated in the sources.","search":"'-112064':13A,16A '-2026':12A,15A 'accept':96C 'access':68B,129C 'arbitrari':77B,141C 'backend':19B,35B,65B,84B,89C,126C,150C 'backend-us':18B 'bound':122C 'compos':21B 'condit':117C 'consent':2A,39B,94C 'cooki':25B 'could':136C 'cve':11A,14A 'data':79B,142C 'databas':22B,50B,78B,110C,145C 'extens':33B 'filter':57B,116C 'frontend':86B,152C 'function':135C 'group':43B,98C 'hash':10A,82B,148C 'histori':3A,40B,71B,95C,132C 'includ':80B,146C 'index':45B,100C 'inject':6A,29B 'leak':7A 'log':63B 'logged-in':62B 'modul':4A,36B,90C 'optin':26B 'option':47B,101C 'page':74B 'paramet':124C 'parameter':60B 'pass':41B 'password':9A,81B,147C 'queri':51B,111C,120C 'read':76B,140C 'request':46B,104C 'review':92C 'sg':24B 'sgalinski/sg-cookie-optin':17A 'show':38B 'sort':42B,97C 'sql':5A,28B 'sql-inject':27B 'statist':73B,134C 'typo3':1A,30B,32B 'typo3-extension':31B 'use':106C,137C 'user':8A,20B,66B,87B,127C,153C 'valid':53B,113C 'valu':58B 'without':52B,112C","nicknames":[],"mitigations":[],"who_affected":"TYPO3 sites with the third-party extension sgalinski Cookie Consent (sg_cookie_optin) installed at 7.4.5 or lower, or 8.0.0 to 8.1.11. The attacker needs a backend login with access to the consent history or statistics functions, then can read any database data including backend and frontend user password hashes. Sites without this extension, or on 7.4.6 / 8.1.12 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:36:56Z","by":"analyst","run_id":753},"products":{"at":"2026-10-25T03:36:56Z","by":"analyst","run_id":753},"how_to_check":{"at":"2026-10-25T03:36:56Z","by":"analyst","run_id":753},"who_affected":{"at":"2026-10-25T03:36:56Z","by":"analyst","run_id":753}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112064","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112064","severity":null,"published_at":"2026-10-20T10:17:03+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112064:753","url":null,"severity":null,"published_at":"2026-10-25T03:36:56+00:00","modified_at":"2026-10-25T03:36:56+00:00","first_seen_at":"2026-10-25T03:36:56+00:00","fetched_at":"2026-10-25T03:36:56+00:00","note":"Primary: TYPO3-EXT-SA-2026-029; extension sgalinski Cookie Consent (sg_cookie_optin), affected <=7.4.5 and 8.0.0-8.1.11, fixed 7.4.6/8.1.12. No exploit/PoC found; not checked X."}],"documents":[{"id":3248,"url":"https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029","title":"TYPO3-EXT-SA-2026-029: sgalinski Cookie Consent (sg_cookie_optin)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}