CVE-2026-112239
Received Received - Intake

Unauthenticated Property Modification in Page Builder Extension

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-112239
EUVD
EUVD-2026-104864

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TYPO3 Extension "TYPO3 AI Integration Extension" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any authenticated backend user to modify any property of any page record in the TYPO3 AI Integration Extension without proper permission checks. This includes changing access permissions and configuration outside the user's granted scope.

Detection Guidance

Check for unauthorized modifications to page records by reviewing TYPO3 backend logs for unexpected changes to page properties or access permissions. Inspect the extension version in use by running the TYPO3 extension manager or checking the composer.json file for the ns_t3ai extension.

Impact Analysis

An attacker could alter page properties, change access permissions, or modify configurations, potentially leading to unauthorized access or site disruption. In TYPO3 versions 10 and 11, the OpenAI API key could also be exposed, causing financial costs.

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, violating compliance requirements for data protection and security in standards like GDPR and HIPAA.

Mitigation Strategies

Update the TYPO3 AI Integration Extension to version 14.0.2 immediately using the TYPO3 extension manager, Packagist, or the official TYPO3 extensions repository. Review and restrict backend user permissions to ensure only authorized users can modify page records.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart