Vulnerability in TYPO3 Extension "sgalinski Cookie Consent"

[ Description ]Official description

The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4053

  TYPO3 Extensions: Multiple vulnerabilities Translated from German

  CVE-2026-113468CVE-2026-112239CVE-2026-112068+12 more CVEs

[ References ]References

• typo3.org/security/advisory/typo3-ext-sa-2026-029