{"id":"CVE-2026-112239","state":"PUBLISHED","title":"Broken Access Control in extension \"TYPO3 AI Integration Extension\" (ns_t3ai)","description":"The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.","publishedAt":"2026-10-20T09:30:46.019Z","updatedAt":"2026-10-20T15:45:50.344Z","severity":{"score":7.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","source":"TYPO3"},"assigner":"TYPO3","products":["TYPO3 Extension \"TYPO3 AI Integration Extension\""],"affected":[{"vendor":"TYPO3","product":"Extension \"TYPO3 AI Integration Extension\"","packageName":"nitsan/ns-t3ai","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"14.0.2","versionType":"semver"}],"collectionURL":"https://packagist.org/"}],"references":["https://typo3.org/security/advisory/typo3-ext-sa-2026-035"],"weaknesses":["CWE-862","CWE-915"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/112xxx/CVE-2026-112239.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-112239","state":"PUBLISHED","datePublished":"2026-10-20T09:30:46.019Z","dateUpdated":"2026-10-20T15:45:50.344Z","assignerShortName":"TYPO3","assignerOrgId":"f4fb688c-4412-4426-b4b8-421ecf27b14a","dateReserved":"2026-10-19T11:29:07.528Z"},"containers":{"cna":{"title":"Broken Access Control in extension \"TYPO3 AI Integration Extension\" (ns_t3ai)","descriptions":[{"lang":"en","value":"The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them."}],"affected":[{"vendor":"TYPO3","product":"Extension \"TYPO3 AI Integration Extension\"","packageName":"nitsan/ns-t3ai","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"14.0.2","versionType":"semver"}],"collectionURL":"https://packagist.org/"}],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-035","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862 Missing Authorization","type":"CWE"},{"cweId":"CWE-915","lang":"en","description":"CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes","type":"CWE"}]}],"providerMetadata":{"shortName":"TYPO3","orgId":"f4fb688c-4412-4426-b4b8-421ecf27b14a","dateUpdated":"2026-10-20T09:30:46.019Z"},"datePublic":"2026-10-20T09:00:00.000Z","credits":[{"lang":"en","value":"Sven Wappler","type":"reporter"},{"lang":"en","value":"Nitsan","type":"remediation developer"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-20T15:45:40.097139Z","id":"CVE-2026-112239","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-20T15:45:50.344Z"}}]}}}