Exposed API Key Vulnerability in TYPO3 Backend by TYPO3 Association
CVE-2026-113459

7.1HIGH

Key Information:

Vendor

Typo3

Status
Extension "typo3 Ai Integration Extension"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113459?

In TYPO3 versions 10 and 11, an improper configuration exposes the OpenAI API key on all backend pages. This vulnerability allows any authenticated backend user to access the embedded API key, which can then be misused for unauthorized actions, potentially compromising the integrity and operational costs for site operators who have configured the API key. Proper security controls and key management practices are crucial to mitigate this risk.

Affected Version(s)

Extension "TYPO3 AI Integration Extension" 0 < 14.0.2

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-035
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sven Wappler
Nitsan
.