Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108862APIPark through 1.9.7-beta IDOR via application authorization endpoints

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in APIPark from APIParkLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 86.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.

Affected products (as reported)

Vendor	Product	Versions
APIParkLab	APIPark	0 – through 1.9.7-beta

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/apipark-cross-app-authorization-uuid third-party-advisory
https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/module/application-authorization/iml.go#L451-L511 technical-description
https://github.com/APIParkLab/APIPark product
VulnCheck Advisory: APIPark through 1.9.7-beta IDOR via application authorization endpoints third-party-advisory