Read the docs
TI-2026-76782 Aliases CVE-2026-113459GHSA-7546-2qgp-jfhx

Sensitive data exposure in TYPO3 AI Integration Extension (ns_t3ai)

Priority LOW 37CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

The TYPO3 AI Integration Extension (ns_t3ai) before 14.0.2 embeds the configured OpenAI API key in every backend page on TYPO3 10 and 11, so the editor plugin can call the OpenAI service from the browser. The key is exposed because sensitive information is inserted into sent data (CWE-201). Any authenticated backend user can read the key and use it at the site operator's expense, but only if an API key has been configured.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Fix Fixed Extension "TYPO3 AI Integration Extension" (TYPO3): 14.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Extension "TYPO3 AI Integration Extension"before 14.0.214.0.2Patch availableCNA
  • Extension "TYPO3 AI Integration Extension" VendorTYPO3 Affected before 14.0.2 Fixed in 14.0.2 Patch available CNA

Remediation

Update the extension to version 14.0.2, which is the fixed version listed for TYPO3 AI Integration Extension.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Extension "TYPO3 AI Integration Extension" (TYPO3) Fixed in 14.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TYPO3 Extension "TYPO3 AI Integration Extension" — typo3.org/security/advisory/typo3-ext-sa-2026-035

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-76778 Broken access control in TYPO3 AI Integration ExtensionPriority LOW 32
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113459
  2. 2026-10-20 Alias added: GHSA-7546-2qgp-jfhx
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences