The sgalinski Cookie Consent extension for TYPO3 contains a missing authorization flaw (CWE-862). Non‑administrative backend users who have access to the module can import a cookie‑consent configuration that injects arbitrary scripts into the frontend of the website. This allows an attacker to run arbitrary code in the context of site visitors, potentially enabling remote code execution or cross‑site scripting attacks.

TYPO3 Extension "sgalinski Cookie Consent" (sg_cookie_optin). No specific affected versions are listed in the advisory, so all currently deployed instances that have not been updated to a patched release should be considered vulnerable.

The CVSS score of 7.1 indicates medium vulnerability severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the TYPO3 backend: an authenticated non‑admin user who can access the cookie‑consent module. Successful exploitation requires the attacker to first obtain backend credentials and negotiate import access, after which any injected script will be served to all site visitors.