{"id":"CVE-2026-113459","kind":"vulnerability","aliases":["CVE-2026-113459"],"related":[],"title":"TYPO3: OpenAI API key exposed in every backend page source","description":"In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.","summary":"On TYPO3 versions 10 and 11, a configured OpenAI API key is embedded in each backend page so the editor plugin can call OpenAI from the browser. Any logged-in backend user can read the key and spend the site operator's OpenAI credits.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","openai","php","self-hosted","typo3"],"not_affected_if":["backend-access-restricted","no-api-key-configured","typo3-12-or-newer"],"how_to_check":"- Check whether an OpenAI API key is configured in the TYPO3 extension or site settings for the AI editor plugin.\n- Inspect the page source of a TYPO3 backend page as a backend user and search for the key prefix `sk-`.\n- Confirm the installed TYPO3 major version is `10` or `11`.","fix":"- unknown","status":"open","published_at":"2026-10-20T10:17:05+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:44+00:00","updated_at":"2026-10-25T03:34:44+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:34:44Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"TYPO3: OpenAI API key exposed in every backend page source","impact":"medium","summary":"On TYPO3 versions 10 and 11, a configured OpenAI API key is embedded in each backend page so the editor plugin can call OpenAI from the browser. Any logged-in backend user can read the key and spend the site operator's OpenAI credits.","category":"ai-tooling","nicknames":[],"who_cares":["typo3","openai","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Backend users read the OpenAI key and run paid API calls","analyst_note":"Fixed version and rotation guidance are not in the sources; check the NVD entry and TYPO3 security advisory for the patched release.","how_to_check":"- Check whether an OpenAI API key is configured in the TYPO3 extension or site settings for the AI editor plugin.\n- Inspect the page source of a TYPO3 backend page as a backend user and search for the key prefix `sk-`.\n- Confirm the installed TYPO3 major version is `10` or `11`.","needs_analyst":true,"not_affected_if":["no-api-key-configured","typo3-12-or-newer","backend-access-restricted"],"who_is_affected":"Sites running TYPO3 10 or 11 that have configured an OpenAI API key for the backend editor plugin. Every backend user with login access can see the key, so editor accounts with low trust are also a concern. Sites without a configured key are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000614,"input_tokens":3321,"output_tokens":564,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113459':13A,16A '-2026':12A,15A '10':29B,76C '11':31B,78C 'ai':18B 'ai-tool':17B 'api':3A,35B,82C,127C 'appli':124C 'authent':105C 'backend':8A,41B,57B,88C,106C 'browser':52B,103C 'call':48B 'configur':33B,80C,131C 'contact':96C 'credit':70B 'cve':11A,14A 'direct':100C 'editor':45B,93C 'embed':38B,85C 'everi':7A,87C 'expens':117C 'expos':5A 'host':24B 'key':4A,36B,62B,83C,111C,128C 'log':55B 'logged-in':54B 'openai':2A,20B,34B,49B,69B,81C,98C 'oper':67B,121C 'page':9A,42B,89C 'php':21B 'plugin':46B,94C 'read':60B,109C 'run':73C 'self':23B 'self-host':22B 'servic':99C 'site':66B,120C 'sourc':10A 'spend':64B 'tool':19B 'typo3':1A,25B,27B,75C 'use':113C 'user':58B,107C 'version':28B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running TYPO3 10 or 11 that have configured an OpenAI API key for the backend editor plugin. Every backend user with login access can see the key, so editor accounts with low trust are also a concern. Sites without a configured key are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113459","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113459","severity":null,"published_at":"2026-10-20T10:17:05+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}