CVE-2026-113459
Received Received - Intake

Exposure of OpenAI API Key in TYPO3 Backend

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: TYPO3

Description
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113459
EUVD
EUVD-2026-104863

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TYPO3 Extension "TYPO3 AI Integration Extension" 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In TYPO3 versions 10 and 11, the TYPO3 AI Integration Extension embeds the configured OpenAI API key in every backend page. This allows any authenticated backend user to read and misuse the key, potentially incurring costs for the site operator.

Detection Guidance

Check if the TYPO3 AI Integration Extension (ns_t3ai) versions 14.0.1 or below are installed. Inspect backend page source code for embedded OpenAI API keys in TYPO3 versions 10 and 11.

Impact Analysis

Authenticated backend users can access and misuse the OpenAI API key, leading to unauthorized usage charges for the site operator. The extension also allows unauthorized modification of page properties, including permissions and configurations.

Mitigation Strategies

Update the TYPO3 AI Integration Extension to version 14.0.2 via the TYPO3 extension manager, Packagist, or the official TYPO3 extensions repository. Remove any exposed OpenAI API keys from backend configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart