Authorization Bypass Vulnerability in APIPark by APIParkLab
CVE-2026-111680

7.2HIGH

Key Information:

Vendor

Apiparklab

Status
Apipark
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111680?

APIPark versions up to 1.9.7-beta enable authenticated team managers to bypass authorization controls. By manipulating the team query parameter, these users can gain unauthorized access to other teams' services and applications, allowing them to read, modify, or delete sensitive data through specific API endpoints such as /api/v1/service/info and /api/v1/app. This vulnerability poses significant risks to data integrity and confidentiality across teams.

Affected Version(s)

APIPark 0 <= 1.9.7-beta

References

https://hackmd.io/@hieuPenguinnn/apipark-cross-team-servi...
third-party-advisory
https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/mo...
technical-description
https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/pl...
technical-description

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.