CVE-2026-111680

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services...

CVE-2026-111680

APIPark versions through 1.9.7-beta are vulnerable to a cross-team authorization bypass (CWE-639). Authenticated team managers can access, read, modify, or delete services and applications belonging to other teams by supplying their own team ID in the team query parameter . Vulnerable endpoints i...

EUVD-2026-102971

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services...

PT-2026-116079

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services...