CVE-2026-112066
Received Received - Intake

Stored XSS in TYPO3 Cookie Consent Extension via JSON Import

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112066
EUVD
EUVD-2026-104873

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
TYPO3 Extension "sgalinski Cookie Consent" 8.0.0
TYPO3 Extension "sgalinski Cookie Consent" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the JSON import feature of the cookie consent configuration in the sgalinski Cookie Consent TYPO3 extension. Non-admin backend users with module access could import a malicious configuration that injects arbitrary scripts into the website's frontend.

Detection Guidance

Check for unauthorized script additions in frontend code by reviewing imported cookie consent configurations. Look for changes in frontend files or database entries related to the TYPO3 extension. No specific commands are provided in the context.

Impact Analysis

An attacker with limited backend access could exploit this to inject scripts, potentially leading to cross-site scripting (XSS) attacks, data theft, or unauthorized actions on behalf of users. This compromises website integrity and user trust.

Compliance Impact

This vulnerability could lead to unauthorized data access or script execution, violating GDPR's data protection requirements and HIPAA's security rules. It may result in non-compliance, legal penalties, and loss of user trust.

Mitigation Strategies

Restrict backend user permissions to prevent non-admin users from importing cookie consent configurations. Review and remove any unauthorized scripts added to frontend. Update the TYPO3 extension to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112066. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart