CVE-2026-112065 in Sgalinski Cookie Consent
Summary
by MITRE • 10/20/2026
The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
This vulnerability represents a critical failure in server-side authorization logic within the application's routing layer, specifically affecting endpoints responsible for retrieving consent history and statistical data. The core technical flaw lies in the absence of proper access control checks before processing requests to these specific routes. While the system correctly authenticates users by verifying their login credentials, it fails to validate whether the authenticated user possesses the necessary permissions or roles required to access sensitive modules or view requested pages. This oversight creates a situation where the application trusts the presence of an active session as sufficient proof of authorization for all subsequent actions, ignoring the principle of least privilege and role-based access control requirements.
The operational impact of this flaw is severe, allowing any authenticated backend user to retrieve consent data belonging to any site within the installation environment. Consent history typically contains sensitive personal information regarding user preferences, cookie acceptances, and privacy settings, which are often subject to strict regulatory frameworks such as GDPR or CCPA. By bypassing permission checks, an attacker with low-level access can escalate their effective privileges to view high-sensitivity data that should be restricted to administrators or specific compliance officers. This leads to a direct violation of confidentiality requirements and exposes the organization to significant legal and reputational risks due to unauthorized disclosure of personal data.
From a classification perspective, this vulnerability aligns directly with CWE-285, which describes Improper Authorization, where an actor is able to access resources or perform actions for which they should not have been granted permission. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and potentially T1098 Account Manipulation if used to gather intelligence for further compromise. The lack of object-level authorization means that even though the user is valid within the system, they are not authorized to interact with specific data objects outside their designated scope.
To mitigate this vulnerability, developers must implement robust access control checks at the route or controller level before any business logic is executed. This involves verifying that the current session's associated role has explicit permission to view consent history and statistics for the requested site identifier. It is essential to enforce both horizontal and vertical access controls, ensuring users cannot access data belonging to other tenants or sites they do not own. Additionally, implementing comprehensive logging of authorization failures can aid in detecting potential exploitation attempts during security audits. Regular code reviews focusing on authentication versus authorization distinctions are recommended to prevent similar oversights in future development cycles.