Description

An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T07:17:15.793Z",
  "pubdate": "2026-09-14T07:17:15.793Z",
  "executiveSummary": "The Content Consent extension for TYPO3 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability due to improper input validation.\nThis flaw resides in versions through 2.0.1, allowing unauthenticated remote attackers to bypass access controls and retrieve arbitrary content elements.\nThe vulnerability occurs because the extension fails to verify if the requested content element identifier is authorized for display by the plugin.\nThis exposes internal content elements that should otherwise remain restricted, posing a significant risk of information disclosure.\nThe impact is critical, as it allows unauthorized access to potentially sensitive or internal site data without requiring administrative or user authentication.\nThe exploitation process is straightforward, requiring no special privileges, as the attacker can manipulate the content identifier parameter in requests directed at the extension to extract restricted information.",
  "technicalDetails": "The vulnerability is an Insecure Direct Object Reference (IDOR) affecting the Content Consent extension for TYPO3 (versions through 2.0.1).\nThe root cause of this security flaw is an authorization bypass resulting from insufficient server-side validation of user-supplied input.\nSpecifically, the extension accepts a content element identifier parameter used to fetch and render content; however, it lacks logic to cross-reference this identifier against a whitelist or verify if the current user session has the requisite permissions to access the specified object.\nBecause there is no integrity or authorization check on the input, the application blindly processes the identifier, effectively trusting user-provided input without mediation.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the parameter responsible for passing the content element ID to the Content Consent plugin. By systematically iterating through numeric or identifiable content element IDs, the attacker sends crafted HTTP requests to the target TYPO3 instance. The plugin, failing to perform a check, queries the database for the provided ID and returns the corresponding content element data in the HTTP response.\nSince the extension does not enforce access controls at the function level, the attacker can successfully exfiltrate information regarding content elements that were intended to be private or restricted to specific pages/users.\nThis behavior facilitates the unauthorized disclosure of protected site content, potentially revealing internal system configuration details, private documentation, or sensitive database records exposed via content elements.\nThe vulnerability is exposed over the network, and because no authentication is required to interact with the plugin's frontend rendering logic, it allows for trivial automated mass-extraction of content.\nThe impact of a successful exploit is the bypass of the intended security boundaries of the TYPO3 Content Consent extension, leading to unauthorized data exposure and potential reconnaissance for further attacks against the TYPO3 environment."
}