CVE-2026-113459
7.1HighPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-201
Impact
Authenticated backend users can extract your configured OpenAI API key and run API queries at your expense. The attacker only needs low-privilege TYPO3 backend access to read the key embedded in the page markup.
Root cause
The backend plugin embeds the raw OpenAI API key directly into client-side backend pages so the browser can call OpenAI directly.
Affected systems
Affected extension versions running on TYPO3 10 and 11; specific extension version ranges are not listed — check the vendor advisory.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade the affected extension once a patched release is published. As an immediate workaround, revoke the exposed OpenAI API key and remove it from the extension configuration until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.