CVE-2026-112064
7.1HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Authenticated backend users can extract arbitrary database records, including user password hashes, via SQL injection. The attacker needs valid credentials with access to the module's history or statistics features.
Root cause
The backend consent history module concatenates user-supplied sorting, grouping, and index parameters directly into SQL queries without validation or parameter binding.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade the affected TYPO3 extension to the fixed release specified in typo3-ext-sa-2026-029, or restrict backend user permissions to remove access to the consent history and statistics modules until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.