CVE-2026-108862: APIPark through 1.9.7-beta IDOR via application authorization endpoints
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.
Affected Software
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker must be authenticated and have authorization-view permission on at least one application. They also need a UUID for an authorization belonging to a different application.
Can credential-hiding settings prevent disclosure?
No. The affected endpoints can return plaintext API keys for another application's authorization even when HideCredential is enabled.
Which endpoints should be reviewed for exposure?
Review access to /api/v1/app/authorization and its details route. Supplying a foreign authorization UUID to either route may expose credentials across application boundaries.