In TYPO3 10 and 11, the extension that integrates OpenAI embeds the configured API key within every backend page so the editor can call the service directly from the browser. Any authenticated administrator or editor can view the page source and capture the key, allowing them to use the OpenAI service at the operator’s expense. The vulnerability does not allow arbitrary code execution but leaks a credential that can be abused for unauthorized use, increasing costs and potentially violating privacy or contractual constraints.

TYPO3 systems running Extension "TYPO3 AI Integration Extension" on versions 10 or 11 are affected whenever a personal OpenAI API key has been entered in the extension configuration. No other TYPO3 versions or extensions are listed as vulnerable.

The CVSS score of 7.1 indicates a medium‑to‑high severity of data exposure. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated backend user with access to the configuration pages; once the key is exposed, it can be used immediately. The impact is confined to credential leakage rather than service disruption, but the cost and reputational risks can be significant if the key is abused.