CVE-2026-112239: high-severity vulnerability in TYPO3 Extension "TYPO3 AI Integration Extension"
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.4%
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "TYPO3 AI Integration Extension"Related CVEs — TYPO3 Extension "TYPO3 AI Integration Extension"
In the same product, most dangerous first.