Authorization Bypass in APIPark

APIPark through version 1.9.7-beta is susceptible to an authorization bypass vulnerability (CVE-2026-111680) that impacts multi-tenant environments. The flaw allows an authenticated user with the 'team manager' role to manipulate the 'team' query parameter in API requests. By substituting their own team ID with that of a target team, an attacker can bypass authorization controls and interact with resources they do not own.

This vulnerability grants attackers the ability to read, modify, or delete services and applications belonging to other teams. The attack is carried out by discovering target service or application IDs through information-gathering endpoints, followed by unauthorized requests to management endpoints. The impact is significant for organizations relying on APIPark for API gateway management, as it undermines the logical separation between teams, potentially leading to unauthorized data exposure or operational disruption of sensitive API services.

Impact

Successful exploitation allows unauthorized users to perform administrative actions on services and applications across different teams. This can result in the loss of service availability, unauthorized modification of API configurations, or the exfiltration of metadata and sensitive details related to internal services. This vulnerability is critical in environments with high internal traffic or multiple distinct development/production teams sharing an APIPark instance.

Recommendation

Prioritized actions for security teams to address CVE-2026-111680:

• Upgrade APIPark to the latest version immediately to remediate the authorization logic flaw identified in CVE-2026-111680.
• Review web server and API gateway access logs for abnormal patterns involving requests to /api/v1/service/info or /api/v1/app where the 'team' parameter does not match the requester's legitimate assigned ID.
• Audit existing team manager permissions and minimize administrative access until the patch is applied.