{"id":"CVE-2026-112066","kind":"vulnerability","aliases":["CVE-2026-112066"],"related":[],"title":"Cookie consent JSON import skips backend permissions, letting users inject scripts","description":"The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.","summary":"The sgalinski Cookie Consent TYPO3 extension did not check backend permissions on JSON import of the consent configuration. A non-admin backend user with module access could import a configuration that injects arbitrary scripts into the site frontend. Fixed in 7.4.6 and 8.1.12.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sgalinski/sg-cookie-optin","fixed":["7.4.6","8.1.12"],"affected":"<= 7.4.5, >= 8.0.0 < 8.1.12","ecosystem":"composer"}],"ecosystems":[],"tags":["cms-backend","cookie-consent","missing-authorization","other","typo3","typo3-extension","xss"],"not_affected_if":["auth-required","fixed-version","no-non-admin-backend-users","no-sg-cookie-optin"],"how_to_check":"Run 'composer show sgalinski/sg-cookie-optin' (or check the Extension Manager in the TYPO3 backend). Exposed if the version is 7.4.5 or lower, or between 8.0.0 and 8.1.11. Also review existing cookie consent configuration for unexpected script entries added by non-admin backend users.","fix":"Update sgalinski/sg-cookie-optin to 7.4.6 (7.x line) or 8.1.12 (8.x line), via TYPO3 extension manager or composer update sgalinski/sg-cookie-optin.","status":"open","published_at":"2026-10-20T10:17:03+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:43+00:00","updated_at":"2026-10-25T03:35:56+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-25T03:34:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Cookie consent JSON import skips backend permissions, letting users inject scripts","impact":"high","summary":"The JSON import of the cookie consent configuration ignored the backend user's permissions. A non-admin backend user with access to the module can import a configuration that injects arbitrary scripts into the website frontend.","category":"other","nicknames":[],"who_cares":["cookie-consent","cms-backend"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker-chosen scripts run in every visitor's browser on the site","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112066; the sources give no product or version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000506,"input_tokens":3273,"output_tokens":357,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112066; the sources give no product or version.","search":"'-112066':14A,17A '-2026':13A,16A '7.4.6':75B '8.1.12':77B 'access':60B,100C 'add':109C 'admin':55B,96C 'arbitrari':67B,110C 'author':27B 'backend':6A,21B,43B,56B,90C,97C 'check':42B 'cms':20B 'cms-backend':19B 'configur':51B,64B,85C,107C 'consent':2A,24B,37B,50B,84C 'cooki':1A,23B,36B,83C 'cookie-cons':22B 'could':61B,104C 'cve':12A,15A 'extens':32B,39B 'fix':73B 'frontend':72B,114C 'import':4A,47B,62B,80C,105C 'inject':10A,66B 'json':3A,46B,79C 'let':8A 'miss':26B 'missing-author':25B 'modul':59B,103C 'non':54B,95C 'non-admin':53B,94C 'permiss':7A,44B,93C 'respect':88C 'script':11A,68B,111C 'sgalinski':35B 'sgalinski/sg-cookie-optin':18A 'site':71B 'skip':5A 'typo3':29B,31B,38B 'typo3-extension':30B 'user':9A,57B,91C,98C 'websit':117C 'xss':33B","nicknames":[],"mitigations":[],"who_affected":"TYPO3 sites that have the sgalinski Cookie Consent extension (sg_cookie_optin) installed in version 7.4.5 or lower, or 8.0.0 to 8.1.11. The attacker must be a logged-in backend user with access to the module, so sites where only trusted admins have backend accounts face much lower risk. Sites without this extension can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:35:56Z","by":"analyst","run_id":752},"who_affected":{"at":"2026-10-25T03:35:56Z","by":"analyst","run_id":752}},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112066","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112066","severity":null,"published_at":"2026-10-20T10:17:03+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112066:752","url":null,"severity":null,"published_at":"2026-10-25T03:35:56+00:00","modified_at":"2026-10-25T03:35:56+00:00","first_seen_at":"2026-10-25T03:35:56+00:00","fetched_at":"2026-10-25T03:35:56+00:00","note":"Read TYPO3-EXT-SA-2026-029 (primary): sgalinski Cookie Consent (sg_cookie_optin) <=7.4.5 and 8.0.0-8.1.11; fixed 7.4.6 / 8.1.12. No exploitation or PoC reported; no social search done (low-profile TYPO3 ext). Siblings CVE-2026-112064 (SQLi) and -112065 (missing authz on history routes) in same advisory."}],"documents":[{"id":3240,"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-029","title":"TYPO3-EXT-SA-2026-029: sgalinski Cookie Consent (sg_cookie_optin)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}