The sgalinski Cookie Consent extension missed an authorization check on routes that retrieve consent history and statistics. Any authenticated TYPO3 backend user, regardless of their role or module permissions, can access these endpoints and read consent data for any site within the installation. This flaw can lead to the disclosure of user privacy information and could expose sensitive application‑wide consent configurations. The weakness is catalogued as CWE-862, improper authorization.

TYPO3\nExtension: sgalinski Cookie Consent\nNo specific affected versions are listed, indicating all versions of the extension may be vulnerable until an update includes the fix.

The CVSS score of 5.3 indicates moderate overall risk. The EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers require only authenticated access to the TYPO3 backend, a condition that many administrators typically meet. Because no external attack vector is required, the risk is confined to legitimate users who might abuse the lack of authorization checks.