CVE-2026-112065 — Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend u…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7