Is CVE-2026-88897 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-88897?

CVE-2026-88897 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-88897

Description

Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.