CVE Alert: CVE-2026-111680 – APIParkLab

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams’ services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams’ services and applications via /api/v1/service/info and /api/v1/app endpoints.

**Risk verdict:** Treat as high priority in any exposed, multi-team deployment; urgency cannot be confirmed because KEV, SSVC and EPSS status were not supplied.

**Why this matters:** A compromised or malicious low-privilege team manager could cross tenant boundaries to tamper with other teams’ API services and applications. Changes or deletion could disrupt integrations, expose limited service information, or undermine trust in API configurations.

**Most likely attack path:** An attacker needs network access and a valid low-privilege account, but no user interaction or complex conditions. They could enumerate service or application identifiers, then manipulate team parameters in requests to access or alter resources belonging to another team; the assessed scope indicates no direct impact beyond the vulnerable platform.

**Who is most exposed:** Organisations using a shared, multi-team API management deployment are most at risk, particularly where team-manager accounts are numerous or credentials are weakly governed.

Alert on requests where the authenticated user’s team differs from the requested team.

Review service and application reads, edits, or deletions by team-manager accounts.

Look for unusual enumeration of service or application identifiers.

Mitigation and prioritisation

Upgrade to a vendor-fixed release when available; verify the fix with cross-team access tests.

Until patched, restrict access to the management API and limit team-manager accounts.

Review audit logs for cross-team activity and restore unauthorised changes.

Apply changes through controlled testing and change management; preserve logs during investigation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.