CVE-2026-103904
CriticalCVSS 9.3Summary
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend, allowing script code injection that executes in an administrator's browser session.
Risk Assessment
An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator's session, enabling actions with the administrator's privileges, including account takeover.
Recommendation
Update JTL-Shop to a version containing the fix and enforce output encoding and server-side validation of consent names.
Other vulnerabilities in JTL-Shop
See all- CVE-2026-103905High
A vulnerability in JTL-Shop's authentication middleware processes the plugin safe mode toggle on the admin logout route before checking authentication. An unauthenticated attacker can toggle the safe mode, deactivating all plugins and causing a shop-wide denial of service.
- CVE-2026-54390Critical
JTL Shop versions 5.2.0 through 5.7.1 contain a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine.
Original NVD description (English source)
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS