CVE-2026-111680: APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

Q: Who can exploit this issue?

An authenticated user with team manager privileges can exploit it. The attacker needs to know or obtain target service or application IDs exposed by the simple service or app API endpoints.

Q: What data and actions are exposed across teams?

A team manager may be able to read, modify, or delete services and applications belonging to other teams. The affected operations involve the service information and application endpoints.

Q: How can defenders identify possible exposure or abuse?

Review access and audit logs for requests to the service information or application endpoints where the team query parameter does not match the owner team of the referenced service or application. Also review whether service or application IDs were obtainable through the simple listing endpoints.

Published Oct 16, 2026

Updated

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

Affected Software

1 affected component

APIPark APIPark<=1.9.7-beta

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with team manager privileges can exploit it. The attacker needs to know or obtain target service or application IDs exposed by the simple service or app API endpoints.

What data and actions are exposed across teams?

A team manager may be able to read, modify, or delete services and applications belonging to other teams. The affected operations involve the service information and application endpoints.

How can defenders identify possible exposure or abuse?

Review access and audit logs for requests to the service information or application endpoints where the team query parameter does not match the owner team of the referenced service or application. Also review whether service or application IDs were obtainable through the simple listing endpoints.

CVE-2026-111680: APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What data and actions are exposed across teams?

How can defenders identify possible exposure or abuse?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data and actions are exposed across teams?

How can defenders identify possible exposure or abuse?