CVE-2026-112066: Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
Published Oct 20, 2026
·Updated
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
Affected Software
1 affected component
sgalinski Cookie Consent
Event History
Oct 20, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A non-admin backend user who has access to the cookie consent module can exploit it. The issue is limited to users able to use that module's JSON import functionality.
2
What can a successful attacker do?
They can import a cookie consent configuration containing arbitrary scripts that are then added to the website frontend.
3
Are administrators the only affected users?
No. The authorization failure specifically allows non-admin backend users to import configurations beyond their intended permissions, provided they have access to the module.