CVE-2026-113459CWE-201

CVE-2026-113459

published October 20, 2026

CVSS
7.1
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-10-20T14:17Z
References (1)
https://typo3.org/security/advisory/typo3-ext-sa-2026-035 · f4fb688c-4412-4426-b4b8-421ecf27b14a
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 20 OCT 09:30Z
    Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
    cvelistv5
  • 20 OCT 09:30Z
    Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
    cvelistv5