CVE-2026-111680
Deferred Deferred - Pending Action

Authorization Bypass in APIPark via Team ID Manipulation

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-16
EPSS Evaluated
2026-10-18
NVD
CVE-2026-111680
EUVD
EUVD-2026-102971

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
APIParkLab APIPark 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

APIPark through 1.9.7-beta has an authorization bypass flaw where authenticated team managers can access other teams' services and applications by modifying the team query parameter. The system checks permissions based on the team ID in the request, but does not verify if the requested resource belongs to that team. This allows unauthorized read, edit, or delete actions across tenant boundaries.

Detection Guidance

To detect this vulnerability, monitor APIPark endpoints for unauthorized access attempts. Check logs for requests to /api/v1/service/info, /api/v1/app/info, or /api/v1/app with a team query parameter that doesn't match the resource's owner. Look for GET, PUT, POST, or DELETE requests where the team ID in the query parameter differs from the resource's expected team.

Impact Analysis

An attacker with manager privileges in one team could access, modify, or delete services and applications owned by other teams. This could lead to data breaches, service disruptions, or unauthorized changes to configurations. The impact includes confidentiality loss, integrity violations, and potential availability issues for affected services.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict data isolation between tenants, such as GDPR's data protection principles or HIPAA's access controls. Unauthorized cross-team access may result in data exposure, violating regulatory mandates for confidentiality and access control.

Mitigation Strategies

Immediately upgrade APIPark to a patched version beyond 1.9.7-beta. If upgrading is not possible, restrict access to sensitive endpoints by implementing strict team ownership validation in the permit middleware. Ensure the team query parameter is validated against the resource's team ownership before processing requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart