CVE-2026-112239 Details
Description
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
A broken access control vulnerability has been identified in the TYPO3 AI Integration Extension (ns_t3ai), affecting versions through 14.0.1. The vulnerability arises because the extension provides a backend endpoint that allows authenticated users to modify any property of any page record without proper permission checks. This includes the ability to change access permissions and configuration settings, potentially leading to unauthorized changes within the TYPO3 backend.
Users of the TYPO3 AI Integration Extension are advised to update to version 14.0.2, available through the TYPO3 Extension Manager, Packagist, or the TYPO3 Extensions Repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2026-035 | TYPO3 | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | TYPO3 |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 AI Integration Extension | <= 14.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | TYPO3 |