Sgalinski Cookie Consent CVE-2026-112065

Exploitation requires a valid authenticated TYPO3 backend account of any privilege level (PR:L); the consent-history and statistics routes fail to check whether the backend user has access to the module or the requested page, so even a minimally privileged editor can reach them. There are no special feature-enablement or non-default-configuration prerequisites noted in the advisory - the flaw is in the routes themselves as shipped. The principal limiting factor is that unauthenticated outsiders cannot exploit it: an attacker must first hold backend credentials, making this primarily an insider or post-credential-compromise exposure; impact is confined to disclosure of cookie-consent history/statistics data across sites, with no integrity or availability effect.

This is a medium-severity information disclosure issue best characterized as a real but bounded priority rather than an urgent fire. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N, 5.3) is internally consistent with the description: network-reachable, low attack complexity, but requiring low-level privileges (PR:L) - i.e., any authenticated backend user. The confidentiality-only impact (VC:L, no integrity or availability impact) matches a CWE-862 missing-authorization flaw that leaks consent history/statistics. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven almost entirely by the authorization model rather than by observed threat activity. The key limiting factor is the authentication requirement - an attacker must already hold valid (even minimally privileged) backend credentials, which makes this far more relevant as an insider/privilege-boundary issue or a post-compromise escalation than as a mass-exploitable internet-facing bug. No signals conflict: all available data points consistently to a low-privilege, confidentiality-only exposure. Missing data to note: no affected/fixed version range was supplied beyond the CPE wildcard, and no EPSS/KEV/POC telemetry was provided to gauge real-world interest.

An attacker who has obtained any TYPO3 backend account - for example a low-privilege editor, or an outsider who phished or guessed weak credentials - directly requests the consent-history and statistics routes. Because these routes never verify module or page access, the attacker retrieves cookie-consent data for any site in the installation, including sites they were never authorized to see. No public exploit code was identified at time of analysis, and the attack requires only ordinary authenticated HTTP requests.