Description
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.
Published: 2026-10-16
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Authorization bypass allowing team managers to access, modify, or delete services and applications of other teams
Action: Immediate Patch
AI Analysis

Impact

APIPark suffers from an authorization bypass that lets a user with team manager privileges specify a different team id in the query parameter to read, modify, or delete assets belonging to other teams. By targeting the /api/v1/simple/services and /api/v1/simple/apps endpoints to obtain service or app IDs, the attacker can then call /api/v1/service/info and /api/v1/app to perform full read, update, or delete operations. The consequence is a loss of confidentiality, integrity, and potentially availability for the affected teams' services and applications.

Affected Systems

APIPark by APIParkLab is affected in releases up to and including version 1.9.7-beta. Any deployment that uses the default API configuration and has at least one authenticated team manager is susceptible.

Risk and Exploitability

The CVSS base score of 7.2 classifies this vulnerability as high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits yet. The attack vector is via the web API, requiring a valid team‑manager login and the ability to supply a team query parameter. Despite the limited prerequisites, the ability to compromise data and services across teams warrants swift remediation.

Generated by OpenCVE AI on October 16, 2026 at 19:11 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patched release of APIPark or patch the iml.go and service.go modules that handle the team parameter to enforce correct authorization checks.
  • Implement server‑side validation that ensures the team id supplied in the request matches the authenticated user's team, rejecting or ignoring mismatches.
  • Audit API logs for unusual cross‑team activity and set up alerts or rate limits for repeated attempts to access resources of other teams.
  • Review role assignments to limit the number of users who hold team manager privileges and rotate credentials regularly.

Generated by OpenCVE AI on October 16, 2026 at 19:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apiparklab
Apiparklab apipark
Vendors & Products Apiparklab
Apiparklab apipark

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.
Title APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apiparklab Apipark
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T13:30:28.317Z

Reserved: 2026-10-16T14:31:18.963Z

Link: CVE-2026-111680

cve-icon Vulnrichment

Updated: 2026-10-19T13:30:14.056Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:50.923

Modified: 2026-10-19T14:16:59.370

Link: CVE-2026-111680

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T15:15:10Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key