Skip to content
CVE-2026-111680: APIPark Authorization Bypass Vulnerability Disclosed

CVE-2026-111680: APIPark Authorization Bypass Vulnerability Disclosed

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 16:38 UTC
  • •CVE-2026-111680 allows unauthorized access across teams in APIPark.
  • •Organizations using multi-team API deployments are at high risk.
  • •Immediate mitigation includes restricting API access and monitoring logs.

A high-priority authorization bypass vulnerability (CVE-2026-111680) has been identified in APIPark versions up to 1.9.7-beta. This flaw allows authenticated team managers to access and manipulate services and applications of other teams by altering the team query parameter. Attackers can exploit this vulnerability to read, modify, or delete resources, posing a significant risk to organizations using shared, multi-team API management deployments. The vulnerability was published on October 16, 2026, with a CVSS score of 7.2, indicating a high severity level. Organizations are advised to upgrade to a vendor-fixed release when available and to restrict access to the management API until patched. No current exploitation in the wild has been reported, but the potential for abuse exists due to the nature of the vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-10-16
CVE-2026-111680 published
APIPark disclosed a high-severity authorization bypass vulnerability affecting versions up to 1.9.7-beta.
Redpacketsecurity
2026-10-17
Vulnerability awareness raised
Vulncheck published an advisory on the authorization bypass vulnerability, emphasizing its impact.
www.vulncheck.com

More articles in this cluster (3)

Following this threat?

Track CVE-2026-111680 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 4

Common questions

What versions of APIPark are affected?
APIPark versions up to and including 1.9.7-beta are affected by this vulnerability.
Is there any active exploitation reported?
No active exploitation has been reported as of now.
What should organizations do to mitigate this risk?
Organizations should restrict access to the management API and monitor for unusual activity until a patch is available.