CVE-2026-112066
CVE-2026-112066 · Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
CVSS 7.1 · High · EPSS 0.4% · Fix available
- Published
- Updated
Affected products and versions
extension "sgalinski cookie consent"
- Versions
- ≥ 8.0.0, < 8.1.12: Affected (semver)
- ≥ 0, < 7.4.6: Affected (semver)
Update to 7.4.6; Update to 8.1.12