CVE-2026-112239
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
- State
- Published
- Severity
- 7.2 High
- Published
- Oct 20, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 19, 2026
Description
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N | TYPO3 |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Extension "TYPO3 AI Integration Extension"TYPO3 |
|
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-035vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.