Skip to content
OpenAdvisories
High · 7.1 CVE-2026-112066 EUVD-2026-104873GHSA-7vqw-m2xw-v7w9

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

Published Oct 20, 2026 · Updated Oct 20, 2026 · Assigned by TYPO3

Description

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

Affected products

VendorProductAffectedFixed
TYPO3 Extension "sgalinski Cookie Consent" 8.0.0 – < 8.1.12, < 7.4.6 8.1.12

Advisories 1

References