{"id":"CVE-2026-88897","state":"PUBLISHED","title":"Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String","description":"Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.","publishedAt":"2026-09-10T14:46:36.512Z","updatedAt":"2026-09-15T14:38:11.704Z","severity":{"score":8.2,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["flextype flextype"],"affected":[{"vendor":"flextype","product":"flextype","packageURL":"pkg:composer/flextype/flextype","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.0-alpha.3","versionType":"semver"}]}],"references":["https://github.com/flextype/flextype/issues/598","https://github.com/flextype/flextype","https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Endpoints/Api.php","https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-api-token-exposure-via-query-string"],"weaknesses":["CWE-598"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/88xxx/CVE-2026-88897.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-88897","state":"PUBLISHED","datePublished":"2026-09-10T14:46:36.512Z","dateUpdated":"2026-09-15T14:38:11.704Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-09-10T11:28:50.297Z"},"containers":{"cna":{"title":"Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String","descriptions":[{"lang":"en","value":"Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access."}],"affected":[{"vendor":"flextype","product":"flextype","packageURL":"pkg:composer/flextype/flextype","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"1.0.0-alpha.3","versionType":"semver"}]}],"references":[{"url":"https://github.com/flextype/flextype/issues/598","tags":["issue-tracking"],"name":"GitHub Issue #598"},{"url":"https://github.com/flextype/flextype","tags":["product"]},{"url":"https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Endpoints/Api.php","tags":["technical-description"]},{"url":"https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-api-token-exposure-via-query-string","name":"VulnCheck Advisory: Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.2,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-598","lang":"en","description":"Use of GET Request Method With Sensitive Query Strings","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-10T14:46:36.512Z"},"datePublic":"2026-09-09T00:00:00.000Z","credits":[{"lang":"en","value":"Ali Khafagy","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-15T14:38:00.540606Z","id":"CVE-2026-88897","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-15T14:38:11.704Z"}}]}}}