CVE-2026-88897

Deferred Deferred - Pending Action

Flextype CMS API Credential Exposure via URL Parameters

Publication date: 2026-09-10

Last updated on: 2026-09-15

Assigner: VulnCheck

Description

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-15

Generated

2026-10-19

AI Q&A

2026-09-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-88897

EUVD

EUVD-2026-75542

Affected Vendors & Products

Vendor	Product	Version / Range
flextype	flextype	to 1.0.0-alpha.3 (inc)
flextype	cms	to 1.0.0-alpha.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-598	The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Attack-Flow Graph

Executive Summary

CVE-2026-88897 is a vulnerability in Flextype CMS versions up to 1.0.0-alpha.3 where API authentication credentials are passed through URL query strings in REST API routes. This allows attackers with access to server, proxy, or monitoring logs to recover valid API token pairs and gain full API access. The issue stems from improper handling of tokens in the Api.php file, where query parameters and body parameters are merged before validation, exposing sensitive credentials.

Detection Guidance

Check web server, proxy, or monitoring logs for GET requests containing API tokens in query strings. Look for URLs with parameters like 'token' or 'access_token' in Flextype API endpoints.

Impact Analysis

If you use Flextype CMS versions up to 1.0.0-alpha.3, attackers could exploit this vulnerability to gain unauthorized access to your API endpoints. This could lead to data breaches, unauthorized modifications, or complete control over your CMS. The exposure of API tokens in logs means even indirect access to logs (e.g., through shared hosting or third-party services) could compromise your system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or exposure. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. If API tokens are exposed, attackers could access sensitive data, violating these regulations and potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Disable GET requests for API endpoints in Flextype CMS. Ensure API tokens are only passed via request body or authorization headers. Update to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-88897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70