Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-112239

Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)

Description

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "TYPO3 AI Integration Extension"

Default version status: unaffected

  • 0 to < 14.0.2affected

References