Authorization Bypass Vulnerability in TYPO3 by TYPO3 Association
CVE-2026-112065

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "sgalinski Cookie Consent"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112065?

The vulnerability allows any authenticated backend user to access sensitive consent data across an entire TYPO3 installation without proper authorization checks. Specifically, routes intended for consent history and statistics data fail to verify whether the user has the necessary permissions to access these modules, leading to potential data exposure and privacy concerns.

Affected Version(s)

Extension "sgalinski Cookie Consent" 8.0.0 < 8.1.12

Extension "sgalinski Cookie Consent" 0 < 7.4.6

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-029
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Stefan Galinski
.