Vulnerability · Published Oct 20, 2026 · Assigned by TYPO3

CVE-2026-112064SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

High 7.1

In plain English

A high-severity SQL injection in Extension "sgalinski Cookie Consent" from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	Extension "sgalinski Cookie Consent"	8.0.0 – before 8.1.120 – before 7.4.6

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-029 vendor-advisory