# CVE-2023-50462: TYPO3 Content Consent extension insecure direct object reference

Source: https://junglewise.ai/threats/cve-2023-50462-typo3-content-consent-extension-insecure-direct-object-reference  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2023-50462 · Severity: medium · CVSS 5.3 · Published 2026-09-14

The Content Consent extension for TYPO3 fails to properly validate access to content elements, allowing unauthenticated users to view any content element by guessing or enumerating its identifier. This could expose internal or restricted content such as draft articles, private messages, or sensitive data that should only be visible to authorized users.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2023-50462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-50462 being exploited in the wild.

**How severe is CVE-2023-50462?** Medium severity, with a CVSS score of 5.3, published 14 September 2026.

**Which products and versions are affected?** t3s/content-consent (Packagist) ECOSYSTEM:introduced=2.0.0,fixed=2.0.2; Typo3 Content Consent extension 1.0.2 and below, 2.0.0 - 2.0.1.

**Is there a fix for CVE-2023-50462?** Yes. t3s/content-consent (Packagist): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-50462 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-50462?** Check whether you run t3s/content-consent (Packagist) or Typo3 Content Consent extension at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- t3s/content-consent (Packagist): upgrade to 2.0.2 or later

  ```sh
  composer require t3s/content-consent:^2.0.2
  ```


## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the Content Consent extension for TYPO3, affecting versions 1.0.2 and earlier, and 2.0.0 through 2.0.1. The extension fails to validate whether a user has permission to view a specific content element identifier before displaying it. An unauthenticated attacker can access the plugin's endpoints with arbitrary content element identifiers and retrieve content that should be restricted. No authentication or user interaction is required—the attacker simply needs network access to the TYPO3 instance. The issue permits complete disclosure of content elements protected by the extension, potentially exposing internal or sensitive information. Fixed versions 1.0.3 and 2.0.2 are available and should be applied immediately.

## Affected products

- TYPO3 Content Consent extension 1.0.2 and below, 2.0.0 - 2.0.1

## Identifiers

- CVE-2023-50462
- GHSA-j8cw-ppmv-wj85

## Timeline

- 2023-12-13: disclosed
- 2023-12-13: advisory

## References

- [https://typo3.org/security/advisory/typo3-ext-sa-2023-009](https://typo3.org/security/advisory/typo3-ext-sa-2023-009)