TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
- Release Date: October 20, 2026
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "sgalinski Cookie Consent" (sg_cookie_optin)
- Composer Package Name: sgalinski/sg-cookie-optin
- Vulnerability Type: SQL Injection, Missing Authorization
- Affected Versions: 7.4.5 and below, 8.0.0 - 8.1.11
- Severity: High
- Suggested CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- References: CVE-2026-112064, CVE-2026-112065, CVE-2026-112066, CWE-89, CWE-862
Problem Description
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users. (CVE-2026-112064)
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation. (CVE-2026-112065)
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website. (CVE-2026-112066)
Solution
Updated versions 7.4.6 and 8.1.12 are available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/sg_cookie_optin/7.4.6/zip
https://extensions.typo3.org/extension/download/sg_cookie_optin/8.1.12/zip
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to HDWSec for reporting the SQL injection vulnerability, and to Stefan Galinski for providing updated versions of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide.
