CVE-2026-88897

Flextype CMS through 1.0.0-alpha.3 (CWE-598) accepts API authentication credentials in URL query string parameters on REST API routes, so tokens are written into web server, proxy, and monitoring logs in plaintext. The flaw is triggered whenever an authenticated REST API request carries credentials in the query string, and any party who can read those logs — log aggregation systems, hosting providers, or anyone who gains access to log storage — can recover valid API token pairs. An attacker who recovers a token pair gains full API access to the affected Flextype instance, a high-impact confidentiality issue reflected in the 8.2 CVSS 4.0 score. Any deployment of Flextype up to and including 1.0.0-alpha.3 that exposes the REST API and sends credentials in query strings is affected. There is no known public proof of concept, the issue is not in the CISA KEV catalog, and exploitation has not been observed.

What to do: Rotate any Flextype REST API token pairs whose requests could have been logged, and purge or restrict access to web server, proxy, and monitoring log archives that may contain them. Upgrade to a patched Flextype release when available (no fixed version is identified in the available data), and in the meantime configure API clients to pass credentials via headers instead of query strings and limit who can read log storage.