{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/apipark/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apipark:apipark:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-111680"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["APIPark (\u003c= 1.9.7-beta)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","authorization-bypass","api-security"],"_cs_type":"advisory","_cs_vendors":["APIPark"],"content_html":"\u003cp\u003eAPIPark through version 1.9.7-beta is susceptible to an authorization bypass vulnerability (CVE-2026-111680) that impacts multi-tenant environments. The flaw allows an authenticated user with the 'team manager' role to manipulate the 'team' query parameter in API requests. By substituting their own team ID with that of a target team, an attacker can bypass authorization controls and interact with resources they do not own.\u003c/p\u003e\n\u003cp\u003eThis vulnerability grants attackers the ability to read, modify, or delete services and applications belonging to other teams. The attack is carried out by discovering target service or application IDs through information-gathering endpoints, followed by unauthorized requests to management endpoints. The impact is significant for organizations relying on APIPark for API gateway management, as it undermines the logical separation between teams, potentially leading to unauthorized data exposure or operational disruption of sensitive API services.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized users to perform administrative actions on services and applications across different teams. This can result in the loss of service availability, unauthorized modification of API configurations, or the exfiltration of metadata and sensitive details related to internal services. This vulnerability is critical in environments with high internal traffic or multiple distinct development/production teams sharing an APIPark instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams to address CVE-2026-111680:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade APIPark to the latest version immediately to remediate the authorization logic flaw identified in CVE-2026-111680.\u003c/li\u003e\n\u003cli\u003eReview web server and API gateway access logs for abnormal patterns involving requests to /api/v1/service/info or /api/v1/app where the 'team' parameter does not match the requester's legitimate assigned ID.\u003c/li\u003e\n\u003cli\u003eAudit existing team manager permissions and minimize administrative access until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:49:58Z","date_published":"2026-10-16T18:49:58Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apipark-auth-bypass/","summary":"APIPark versions through 1.9.7-beta are vulnerable to an authorization bypass allowing authenticated team managers to manipulate team IDs to access, modify, or delete resources belonging to other teams.","title":"Authorization Bypass in APIPark","url":"https://feed.craftedsignal.io/briefs/2026-10-apipark-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - APIPark","version":"https://jsonfeed.org/version/1.1"}