CVE-2026-111680
highAPIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applicati…
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/APIParkLab/APIPark disclosure@vulncheck.com
- https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/module/permit/team/iml.go#L70-L78 disclosure@vulncheck.com
- https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/plugins/core/service.go#L16-L40 disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/apipark-through-1.9.7-beta-cross-team-authorization-b... disclosure@vulncheck.com
- https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass 134c704f-9b21-4f2e-91b3-4a467353bcc0