Critical · published October 14, 2026
The public consent endpoint of JTL-Shop accepts arbitrary
consent names from unauthenticated visitors without validating
them against the configured consent items. These names are stored in the consent
statistics and rendered without output encoding in the administration
backend. An unauthenticated remote attacker can thereby inject script code that
is executed in the browser session of an administrator viewing the consent
statistics page, allowing actions to be performed with the administrator's
privileges.