CVE-2026-112065
Received Received - Intake

Unauthorized Consent Data Access in TYPO3 CMS

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112065
EUVD
EUVD-2026-104875

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "sgalinski Cookie Consent" 8.0.0
TYPO3 Extension "sgalinski Cookie Consent" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper access control in the sgalinski Cookie Consent TYPO3 extension. Routes for consent history and statistics did not verify if backend users had permission to access the module or page. As a result, any authenticated backend user could retrieve consent data for any site in the installation, regardless of their actual permissions.

Detection Guidance

Check TYPO3 backend access logs for unusual requests to consent history or statistics endpoints. Review user permissions in the backend to identify accounts with unexpected access to sensitive data. Inspect network traffic for unauthorized API calls to /consent/ or similar routes.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive consent data, potentially exposing user privacy preferences. It could lead to data breaches, compliance violations, and loss of trust in the system handling consent management.

Compliance Impact

This vulnerability likely violates GDPR and other privacy regulations by enabling unauthorized access to personal data. It could result in non-compliance with data protection requirements, leading to legal penalties, fines, and reputational damage for organizations using the affected extension.

Mitigation Strategies

Update the sgalinski Cookie Consent extension to the latest patched version. Audit and restrict backend user permissions to only necessary modules. Implement server-side checks to validate user access before serving consent data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112065. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart