CVE-2026-112239: Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
Published Oct 20, 2026
·Updated
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
Affected Software
1 affected component
Typo3 TYPO3 AI Integration Extension (ns_t3ai)
Event History
Oct 20, 2026
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionWeakness
Data Sourced
via NVD·10:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Are affected or fixed extension versions identified?
No affected or fixed version ranges are provided in the available data.
2
When was this vulnerability published?
It was published on 2026-10-20 and was last modified on the same date.