CVE-2026-112065

MediumCVSS 5.3/10Last modified Oct 20, 2026

Description

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1120667.1The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to t CVE-2026-1120676.9The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image c CVE-2026-1120685.3The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore ope CVE-2026-1120696.3The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were CVE-2026-112079.6Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perf CVE-2026-1120705.3The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user CVE-2026-1120716.9The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it CVE-2026-1120736.3A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this vulnerability is the functio CVE-2026-1120746.3A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function n CVE-2026-1120756.3A weakness has been identified in unslothai unsloth up to 0.1.501-beta. This affects the function FastSentenceTransformer._is_transformer_mo CVE-2026-1120765.6A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.__writ CVE-2026-1120775.6A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r_core_cmd_str_pipe in the library libr/core/