CVE-2026-88897
Received Received - Intake

Flextype CMS API Credential Exposure via URL Parameters

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88897
EUVD
EUVD-2026-75542

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flextype flextype to 1.0.0-alpha.3 (inc)
flextype cms to 1.0.0-alpha.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88897 is a vulnerability in Flextype CMS versions up to 1.0.0-alpha.3 where API authentication credentials are passed through URL query strings in REST API routes. This allows attackers with access to server, proxy, or monitoring logs to recover valid API token pairs and gain full API access. The issue stems from improper handling of tokens in the Api.php file, where query parameters and body parameters are merged before validation, exposing sensitive credentials.

Detection Guidance

Check web server, proxy, or monitoring logs for GET requests containing API tokens in query strings. Look for URLs with parameters like 'token' or 'access_token' in Flextype API endpoints.

Impact Analysis

If you use Flextype CMS versions up to 1.0.0-alpha.3, attackers could exploit this vulnerability to gain unauthorized access to your API endpoints. This could lead to data breaches, unauthorized modifications, or complete control over your CMS. The exposure of API tokens in logs means even indirect access to logs (e.g., through shared hosting or third-party services) could compromise your system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or exposure. GDPR requires protecting personal data, and HIPAA mandates securing protected health information. If API tokens are exposed, attackers could access sensitive data, violating these regulations and potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Disable GET requests for API endpoints in Flextype CMS. Ensure API tokens are only passed via request body or authorization headers. Update to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart