CVE-2026-112239High· 7.2▾ TwilightThe extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user ca…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
nitsan/ns-t3ai < 14.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113459High· 7.1Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
CVE-2026-112069Medium· 6.3Broken Access Control in extension "FAL Protect" (fal_protect)
CVE-2026-112070Medium· 5.3Broken Access Control in extension "Analytics" (analytics)
CVE-2026-113468Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
CVE-2026-112071Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
CVE-2026-112066High· 7.1Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)