CVE-2026-111680

HIGH 8.3

APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

CVSS Score

8.3

EPSS Score

0.0%

EPSS Percentile

0th

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

CWE	CWE-639
Vendor	apiparklab
Product	apipark
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for apiparklab apipark

Be the first to know when new high vulnerabilities affecting apiparklab apipark are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Affected Versions

APIParkLab / APIPark

0 ≤ 1.9.7-beta

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass github.com: https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/module/permit/team/iml.go#L70-L78 github.com: https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/plugins/core/service.go#L16-L40 github.com: https://github.com/APIParkLab/APIPark vulncheck.com: https://www.vulncheck.com/advisories/apipark-through-1.9.7-beta-cross-team-authorization-bypass-via-team-query-parameter

Credits

hieuPenguinnn