Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111680APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

High 8.3

In plain English

A high-severity authorization bypass via user-controlled key in APIPark from APIParkLab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

Affected products (as reported)

Vendor	Product	Versions
APIParkLab	APIPark	0 – through 1.9.7-beta

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References

https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass third-party-advisory
https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/module/permit/team/iml.go#L70-L78 technical-description
https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/plugins/core/service.go#L16-L40 technical-description
https://github.com/APIParkLab/APIPark product
VulnCheck Advisory: APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter third-party-advisory