Executive brief
Flextype CMS, a flat-file content management system, improperly passes API authentication credentials through visible URL query string parameters instead of secure headers. Attackers with access to web server logs, proxy logs, or network monitoring tools can extract valid API tokens that grant full administrative access to the CMS, enabling unauthorized content modification, deletion, or system compromise.
Technical details
The vulnerability is an authentication credential exposure flaw in Flextype CMS REST API endpoints, where authentication tokens are accepted and transmitted as URL query string parameters rather than in HTTP headers or the request body. This violates secure credential handling practices, as query parameters are logged in plain text by web servers, reverse proxies, access logs, and monitoring systems. An attacker with read access to these logs (via server compromise, log aggregation systems, or proxy inspection) can recover valid API token pairs. The REST API endpoints process these credentials from the URL without enforcing secure transmission, allowing full API access. Versions up to and including 1.0.0-alpha.3 are affected. The fix requires moving credential handling to HTTP Authorization headers or POST body parameters with HTTPS enforcement.
Affected products
- Flextype Flextype CMS through 1.0.0-alpha.3
Timeline
- 2026-09-10: disclosed