API Token Exposure in Flextype CMS by Flextype
CVE-2026-88897

8.2HIGH

Key Information:

Vendor: Flextype
Status: Flextype
Vendor: CVE Published:; 10 September 2026

What is CVE-2026-88897?

Flextype CMS versions up to 1.0.0-alpha.3 allow API authentication credentials to be sent via URL query string parameters. This design flaw exposes API tokens to attackers who may access server logs, web proxies, or monitoring tools. Valid token pairs can be harvested, granting unrestricted access to the API endpoints, potentially compromising the security of the entire CMS.