Nitsan

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 10 through 11 **Description** When an API key is configured, the OpenAI API key is embedded in every backend page to allow the editor plugin to communicate with the OpenAI service directly from the browser. This allows any authenticated backend user to access the key and utilize the service at the expense of the site operator. **Recommendations** Update TYPO3 versions 10 through 11 to a version where the API key is no longer exposed in the backend pages.