CVE-2026-112064
HighCVSS 7.1Summary
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
Risk Assessment
An authenticated backend user may read arbitrary database data, including user password hashes, potentially leading to account takeover.
Recommendation
Update the extension to a patched version and verify validation of sorting, grouping and index options in queries.
Other vulnerabilities in Nieznane rozszerzenie TYPO3
See all- CVE-2026-112239High
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
- CVE-2026-112238High
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query, allowing an attacker to read data from the database. The issue affects every searched field.
- CVE-2026-112066High
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
Original NVD description (English source)
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS