PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111680 APIParkLab CVE debrief

The CVE Program has published a record for APIPark through 1.9.7-beta, which contains an authorization bypass vulnerability. This vulnerability allows authenticated team managers to access other teams' services and applications by manipulating the team query parameter. The affected product is APIPark, and the vulnerability has been assigned a CVSS score of 7.2, indicating a high severity level.

Vendor
APIParkLab
Product
APIPark
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-19
Advisory published
2026-10-16
Advisory updated
2026-10-19

Who should care

Defenders responsible for APIPark instances, security teams, and administrators of services and applications built on APIPark should be aware of this vulnerability and assess their exposure.

Why it matters

This vulnerability in APIPark through 1.9.7-beta allows authenticated team managers to bypass authorization and access other teams' services and applications. Defenders should verify the presence of this vulnerability, assess exposure, and prioritize applying patches or updates to prevent potential unauthorized access and data breaches.

  • Potential unauthorized access to sensitive services and applications.
  • Possible data breaches or modifications due to bypassed authorization.
  • Need for verification of APIPark instances and exposure assessment.
  • Priority on applying patches or updates provided by APIParkLab.

Technical summary

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. This could lead to unauthorized access to sensitive services and applications. The affected product is APIPark, and defenders should verify the presence of this vulnerability, assess exposure, and prioritize applying patches or updates to prevent potential unauthorized access and data breaches. The vulnerability has been assigned a CVSS score of 7.2, indicating a high severity level.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their APIPark instances and assess exposure, as it could lead to unauthorized access to sensitive services and applications.

Recommended defensive actions

  • Verify the presence of APIPark in your environment and assess exposure to this vulnerability.
  • Review and restrict access to team query parameters to prevent unauthorized access.
  • Monitor for suspicious activity related to APIPark services and applications.
  • Apply patches or updates provided by the vendor, APIParkLab, as soon as available.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Additional sources, including a technical description and product information, are also available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111680 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111680

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111680 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111680

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111680.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/module/permit/team/iml.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/APIParkLab/APIPark/blob/v1.9.7-beta/plugins/core/service.go

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/APIParkLab/APIPark

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/apipark-through-1.9.7-beta-cross-team-authorization-bypass-via-team-query-parameter

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.