All vulnerabilities
CVE-2026-113459

Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)

TYPO3 Extension "TYPO3 AI Integration Extension"Applications & CMS
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in14.0.2Fixed versionCVE List
Published20 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

  • 14.0.2Extension "TYPO3 AI Integration Extension"CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

Text from CVE List

Affected versions 1

  • Extension "TYPO3 AI Integration Extension"affected: all versions before 14.0.2CVE List

References 1