← Database

CVE-2026-88897

MEDIUM CVSS: 5.9 Published: 2026-09-10 Modified: 2026-09-15

Description

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.

Affected Platforms

Unknown

Weakness Type

CWE-598

References