High severity · published Oct 20, 2026
CVE-2026-112066
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Extension "sgalinski Cookie Consent" · TYPO3
8.0.0 before 8.1.12; before 7.4.6 · source: vendor
Affected product
ES
Extension "sgalinski Cookie Consent"
TYPO3
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112066
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112066
typo3.org
https://typo3.org/security/advisory/typo3-ext-sa-2026-029
More from Extension "sgalinski Cookie Consent"
7.1
CVE-2026-112064
SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
5.3
CVE-2026-112065
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)