CVE-2026-112064: SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

Vulnerability summary

CVE-2026-112064 is a high (CVSS 7.1) vulnerability in typo3 extension "sgalinski cookie consent". EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30.5% of scored vulnerabilities.

Timeline

1. 20-10-2026
   PublishedVulnerability first disclosed.
2. 24-10-2026
   Last modifiedVulnerability information updated.

Description

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

• CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.