{"data":{"id":"fd9e5793-beed-43a9-93e3-de0f0c6a4634","title":"CVE-2026-113459: In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the…","summary":"In TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page so the editor plugin can call the OpenAI service directly from the browser. Any authenticated backend user can read the key and spend the site operator's quota. The issue only applies when an API key has been configured.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113459","publishedAt":"2026-10-20T10:17:05.540Z","cveId":"CVE-2026-113459","cweIds":["CWE-201"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["OpenAI API","TYPO3 OpenAI editor plugin"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"TYPO3 OpenAI API key exposed to backend users in page source","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-20T12:08:19.706Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-20T12:08:22.985Z","patchAvailable":null,"disclosureDate":"2026-10-20T10:17:05.540Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}