Vulnerability · Published Sep 10, 2026 · Assigned by VulnCheck
CVE-2026-88897Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
Medium 5.9
In plain English
A medium-severity security flaw in flextype from flextype. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.6%top 53.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
Affected products (as reported)
Weakness: CWE-598 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Issue #598 issue-tracking
- https://github.com/flextype/flextype product
- https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Endpoints/Api.php technical-description
- VulnCheck Advisory: Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String third-party-advisory