CVE-2026-88897CWE-598

CVE-2026-88897

Medium · published September 10, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-09-10T19:17Z
References (4)
https://github.com/flextype/flextype · [email protected]https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Endpoints/Api.php · [email protected]https://github.com/flextype/flextype/issues/598 · [email protected]https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-api-token-exposure-via-query-string · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 14:46Z
    Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String
    cvelistv5