TYPO3-EXT-SA-2026-035: Multiple vulnerabilities in extension "TYPO3 AI Integration Extension" (ns_t3ai)

• Release Date: October 20, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: “TYPO3 AI Integration Extension” (ns_t3ai)
• Composer Package Name: nitsan/ns-t3ai
• Vulnerability Type: Broken Access Control, Sensitive Data Exposure
• Affected Versions: 14.0.1 and below
• Severity: High
• Suggested: CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
• References: CVE-2026-112239, CVE-2026-113459, CWE-862, CWE-915, CWE-201

Problem Description

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them. (CVE-2026-112239)

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured. (CVE-2026-113459)

Solution

Updated version 14.0.2 is available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/ns_t3ai/14.0.2/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Sven Wappler for reporting the vulnerability and to Nitsan for providing an updated version of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.