Sgalinski Cookie Consent CVE-2026-112066

Requires a valid, authenticated TYPO3 backend account that is NOT an administrator but HAS been granted access to the sgalinski cookie-consent module, plus use of that module's JSON configuration import feature - the authorization check that should limit configuration imports to admins is missing. Exploitation is limited by the need for these existing backend credentials and module permissions (PR:L, no anonymous/public path), so it is realistically an insider or compromised-account scenario rather than opportunistic internet-wide attack; no end-user interaction is required to inject, though resulting script execution occurs in frontend visitors' browsers.

This is a moderate-risk missing-authorization flaw (CWE-862) rather than a critical priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation but requires PR:L - a valid, authenticated backend user. That authentication requirement is the single most important risk limiter: this is not an unauthenticated internet-facing bug but a privilege-boundary failure usable only by someone who already has backend access to the cookie-consent module. Impact is scoped to integrity (VI:H; VC:N/VA:N), consistent with script injection into the frontend rather than data theft or outage. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the real-world threat is primarily an insider or a compromised low-privilege backend account escalating to stored script injection against site visitors. Note the input Tag 'Authentication Bypass' is imprecise - the description and CWE-862 describe a missing authorization / broken access control issue (a low-privilege user doing something only admins should), not a bypass of authentication itself; this does not change severity but should be verified against the TYPO3 advisory.

A non-administrative TYPO3 backend user who has been granted access to the sgalinski cookie-consent module crafts a malicious JSON configuration file and uses the module's import feature to load it, bypassing the permission check that should restrict such changes to admins. Because the imported configuration can add arbitrary scripts to the website frontend, every subsequent visitor's browser executes the attacker's JavaScript, enabling stored cross-site scripting against site visitors. No public exploit code was identified at time of analysis, and exploitation requires an existing authenticated backend account with module access.