CVE-2026-103904

Summary

The JTL-Shop consent endpoint allows unauthenticated users to inject arbitrary script code into consent statistics, which executes in administrators' browsers when viewing admin pages. This cross-site scripting vulnerability can lead to full administrative compromise.

Exploitability

Exploitation requires an unauthenticated attacker to submit malicious consent names via the public endpoint, with no additional preconditions needed for the initial injection, though administrator interaction is required to view the compromised statistics page.

Blast radius

The vulnerability could impact all JTL-Shop installations with public consent endpoints, potentially allowing attackers to hijack administrator sessions and perform privileged actions like modifying shop settings, managing users, or accessing sensitive data.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the public consent endpoint or implement strict validation of consent names against configured items before storing them in statistics, as no fixed version has been published yet.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.