Apipark Through 1.9.7 Beta Cross Team Authorization Bypass Via Team Query Parameter

Back www.vulncheck.com

Apipark Through 1.9.7 Beta Cross Team Authorization Bypass Via Team Query Parameter

www.vulncheck.com • October 17, 2026

Share: View original

APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

APIPark <= 1.9.7-beta

APIPark <= 1.9.7-beta

CWE-639 Authorization Bypass Through User-Controlled Key

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-111680: APIPark Authorization Bypass Vulnerability Disclosed A high-priority authorization bypass vulnerability (CVE-2026-111680) has been identified in APIPark versions up to 1.9.7-beta. This flaw allows authenticated team managers to access and manipulate services and applications of other teams by altering the team query parameter. Attackers can exploit this vulnerability to read, modify, or delete resources, posing a significant risk to organizations using shared, multi-team API management deployments. The vulnerability was published on October 16, 2026, with a CVSS score of 7.2, indicating a high severity level. Organizations are advised to upgrade to a vendor-fixed release when available and to restrict access to the management API until patched. No current exploitation in the wild has been reported, but the potential for abuse exists due to the nature of the vulnerability. 1 sources 63

Extracted Entities

Attack Types (1)

Zero-day Exploit

CWE Weaknesses (1)

CWE-639 - Authorization Bypass Through User-Controlled Key (IDOR)

Vulnerabilities (1)

Authorization Bypass Through User-Controlled Key