---
id: "CVE-2026-112065"
kind: "vulnerability"
aliases: ["CVE-2026-112065"]
title: "Consent history route lacks permission check, exposing consent data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-10-20T10:17:03+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112065", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Consent history route lacks permission check, exposing consent data

Consent history and statistics routes did not verify that a backend user had access to the module or page. Any logged-in backend user, whatever their permissions, can read consent data for every site in the installation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112065

## From the sources

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_