CVE-2026-112064
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 20, 2026
Vendor
unknown
Description
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.