CVE-2026-111680

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

A team manager can access other teams' services and applications, leading to unauthorized data disclosure and configuration modification. This can disrupt other teams and compromise system integrity.

Upgrade APIPark to a patched version or enforce authorization control verifying resource ownership by team. Monitor access to service and app endpoints for unauthorized actions.