CVE-2026-108862

MediumCVSS 5.3

Published: 11/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.

Risk Assessment

Exposure of other applications' API keys may allow unauthorized access to protected resources and impersonation of other applications.

Recommendation

Upgrade APIPark to a patched version or enforce resource ownership checks in the /api/v1/app/authorization and details endpoints to prevent reading other applications' credentials.

Other vulnerabilities in APIPark

CVE-2026-111680High
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS