Live › vulnerability › CVE-2026-112066
Go to dashboardThe sgalinski Cookie Consent TYPO3 extension did not check backend permissions on JSON import of the consent configuration. A non-admin backend user with module access could import a configuration that injects arbitrary scripts into the site frontend. Fixed in 7.4.6 and 8.1.12.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
TYPO3 sites that have the sgalinski Cookie Consent extension (sg_cookie_optin) installed in version 7.4.5 or lower, or 8.0.0 to 8.1.11. The attacker must be a logged-in backend user with access to the module, so sites where only trusted admins have backend accounts face much lower risk. Sites without this extension can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| sgalinski/sg-cookie-optin | composer | <= 7.4.5, >= 8.0.0 < 8.1.12 | 7.4.6, 8.1.12 |
composer show sgalinski/sg-cookie-optin (or check the Extension Manager in the TYPO3 backend)7.4.5 or lower, or between 8.0.0 and 8.1.11Update sgalinski/sg-cookie-optin to 7.4.6 (7.x line) or 8.1.12 (8.x line), via TYPO3 extension manager or composer update sgalinski/sg-cookie-optin.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
This page as .md · .json · in your agent: get_signal("CVE-2026-112066")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.