CVE-2026-113459: CWE-201 Insertion of Sensitive Information Into Sent Data in TYPO3 Extension "TYPO3 AI Integration Extension"
Description
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
CVSS v4.0
Score 7.1high
Affected software
TYPO3
Extension "TYPO3 AI Integration Extension"
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113459 describes a vulnerability in the TYPO3 AI Integration Extension where the OpenAI API key is inserted into every backend page for TYPO3 versions 10 and 11. This exposure allows any authenticated backend user to read the API key and misuse it. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). It affects extension versions from 0 up to but not including 14.0.2.
Potential Impact
Any authenticated backend user can obtain the OpenAI API key embedded in backend pages and use it without authorization, potentially incurring costs or misuse at the site operator's expense. There is no indication of privilege escalation or direct compromise of TYPO3 itself, but the exposure of sensitive API credentials is a significant risk.
Mitigation Recommendations
A fix is available in TYPO3 AI Integration Extension version 14.0.2. Operators should upgrade to version 14.0.2 or later to prevent the API key from being exposed in backend pages. Until upgraded, restrict backend user access to trusted personnel only and consider rotating the OpenAI API key if exposure is suspected.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TYPO3
- Date Reserved
- 2026-10-20T07:24:43.155Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad739172cdf04f6561b7990
Added to database: 10/20/2026, 09:49:11 UTC
Last enriched: 10/20/2026, 10:03:24 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.