CVE-2026-112064

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.

• CWE-89

• https://typo3.org/security/advisory/typo3-ext-sa-2026-029

Published

Oct 20, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-112059libLAS through 1.8.1 contains a heap out-of-bounds write vul…6.1
• CVE-2026-11206Insufficient policy enforcement in ServiceWorker in Google C…6.5
• CVE-2026-112060librtmp in RTMPDump through 2.6 contains an out-of-bounds re…6.4
• CVE-2026-112061librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds…4.3
• CVE-2026-112062lwIP through 2.2.1 contains a stack out-of-bounds write vuln…5.9
• CVE-2026-112063libstrophe through 0.14.0 contains a stack-based buffer over…5.9
• CVE-2026-112065The routes that provide consent history and statistics data …5.3
• CVE-2026-112066The JSON import of the cookie consent configuration did not …7.1
• CVE-2026-112067The extension hides the correct answer to each CAPTCHA insid…6.9
• CVE-2026-112068The backend module does not check whether a backend user has…5.3
• CVE-2026-112069The extension no longer applied its access protection to fil…6.3
• CVE-2026-11207Insufficient validation of untrusted input in Autofill in Go…9.6