CVE-2026-112066 — Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuratio…
Published: 2026-10-20 · CVSS: 7.1 · CVSS 4.0
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7