What is GHSA-7546-2qgp-jfhx?

GHSA-7546-2qgp-jfhx is a security advisory published by GitHub Security Advisories with High severity. In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every...

Which CVE IDs does GHSA-7546-2qgp-jfhx cover?

GHSA-7546-2qgp-jfhx covers the following CVE IDs: CVE-2026-113459. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-7546-2qgp-jfhxHigh

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every...

Vendor

GitHub Security Advisories

Published

October 20, 2026

Last Modified

October 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-113459 →

📋 Description

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-113459
https://typo3.org/security/advisory/typo3-ext-sa-2026-035
https://github.com/advisories/GHSA-7546-2qgp-jfhx