CVE-2026-112066

EUVD-2026-104873
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 36.85%
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://typo3.org/security/advisory/typo3-ext-sa-2026-029