CVE-2026-112066
7.1HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Low-privileged backend users can inject arbitrary scripts into the public website by importing malicious cookie configurations. An attacker only needs network access and a non-admin backend account with module access.
Root cause
The JSON import feature for cookie consent configurations fails to perform authorization checks against backend user permissions.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Review the TYPO3 security advisory typo3-ext-sa-2026-029 for the target patch version. In the interim, revoke backend module access for all untrusted non-admin users.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.