---
id: "CVE-2026-112066"
kind: "vulnerability"
aliases: ["CVE-2026-112066"]
title: "Cookie consent JSON import skips backend permissions, letting users inject scripts"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "sgalinski/sg-cookie-optin", "fixed": ["7.4.6", "8.1.12"], "affected": "<= 7.4.5, >= 8.0.0 < 8.1.12", "ecosystem": "composer"}]
ecosystems: []
tags: ["cms-backend", "cookie-consent", "missing-authorization", "other", "typo3", "typo3-extension", "xss"]
not_affected_if: ["auth-required", "fixed-version", "no-non-admin-backend-users", "no-sg-cookie-optin"]
published_at: "2026-10-20T10:17:03+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:35:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112066", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:35:56+00:00"}]
---

# Cookie consent JSON import skips backend permissions, letting users inject scripts

The sgalinski Cookie Consent TYPO3 extension did not check backend permissions on JSON import of the consent configuration. A non-admin backend user with module access could import a configuration that injects arbitrary scripts into the site frontend. Fixed in 7.4.6 and 8.1.12.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:sgalinski/sg-cookie-optin affected <= 7.4.5, >= 8.0.0 < 8.1.12 fixed 7.4.6, 8.1.12

## How to check

Run 'composer show sgalinski/sg-cookie-optin' (or check the Extension Manager in the TYPO3 backend). Exposed if the version is 7.4.5 or lower, or between 8.0.0 and 8.1.11. Also review existing cookie consent configuration for unexpected script entries added by non-admin backend users.

## Fix

Update sgalinski/sg-cookie-optin to 7.4.6 (7.x line) or 8.1.12 (8.x line), via TYPO3 extension manager or composer update sgalinski/sg-cookie-optin.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112066
- 2026-10-25T03:35:56+00:00 analyst — Read TYPO3-EXT-SA-2026-029 (primary): sgalinski Cookie Consent (sg_cookie_optin) <=7.4.5 and 8.0.0-8.1.11; fixed 7.4.6 / 8.1.12. No exploitation or PoC reported; no social search done (low-profile TYPO3 ext). Siblings CVE-2026-112064 (SQLi) and -112065 (missing authz on history routes) in same advisory.

## Documents

- [advisory] TYPO3-EXT-SA-2026-029: sgalinski Cookie Consent (sg_cookie_optin) https://typo3.org/security/advisory/typo3-ext-sa-2026-029

## From the sources

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_