APIParkLab vulnerabilities

Products

• APIPark 2

Latest APIParkLab CVEs

Newest publication first

1. CVE-2026-111680 APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

   Published 2026-10-16

   High·CVSS 7.2 EPSS 0.33%

   APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v...

2. CVE-2026-108862 APIPark through 1.9.7-beta IDOR via application authorization endpoints

   Published 2026-10-11

   Medium·CVSS 6.0 EPSS 0.23%

   APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.