Live › vulnerability › CVE-2026-113459
Go to dashboardOn TYPO3 versions 10 and 11, a configured OpenAI API key is embedded in each backend page so the editor plugin can call OpenAI from the browser. Any logged-in backend user can read the key and spend the site operator's OpenAI credits.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running TYPO3 10 or 11 that have configured an OpenAI API key for the backend editor plugin. Every backend user with login access can see the key, so editor accounts with low trust are also a concern. Sites without a configured key are not exposed.
No product ranges from the sources yet.
sk-.10 or 11.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
This page as .md · .json · in your agent: get_signal("CVE-2026-113459")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.