APIPark up to version 1.9.7-beta contains an insecure direct object reference that allows an authenticated user with authorization-view permission to retrieve the credentials of other applications by supplying a foreign authorization UUID. The attacker can obtain plaintext API keys even when HideCredential is enabled, exposing sensitive authentication material that can be used to access downstream services or impersonate other applications. Because the credentials are retrieved without additional verification of ownership, the impact includes confidential data exposure and potential privilege escalation for the attacker.

The affected product is APIPark from APIParkLab, specifically releases through 1.9.7-beta. The vulnerability is present in the API endpoints handling application authorization, allowing access to foreign application credentials via the provided UUID.

The CVSS base score of 6.0 suggests moderate severity. EPSS is not available, so the likelihood of exploitation is unclear, but the vulnerability is listed as not in the CISA KEV catalog. The attack vector is likely internal, requiring an authenticated user who has the authorization-view permission on one application; the attacker must then query /api/v1/app/authorization or the details route with another application's UUID. Once accessed, the attacker can read plaintext API keys regardless of HideCredential settings, leading to potential compromise of other applications’ services.