PT-2026-118316 · Typo3 · Typo3
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
TYPO3 versions 10 through 11
Description
When an API key is configured, the OpenAI API key is embedded in every backend page to allow the editor plugin to communicate with the OpenAI service directly from the browser. This allows any authenticated backend user to access the key and utilize the service at the expense of the site operator.
Recommendations
Update TYPO3 versions 10 through 11 to a version where the API key is no longer exposed in the backend pages.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Typo3