CVE-2026-108862: Authorization Bypass Through User-Controlled Key in APIParkLab APIPark

CVE-2026-108862 describes an authorization bypass vulnerability in APIPark through version 1.9.7-beta. Authenticated users who have authorization-view permission on one application can exploit an insecure direct object reference by providing a foreign authorization UUID to the /api/v1/app/authorization endpoint or its details route. This allows them to retrieve plaintext API keys of other applications, regardless of the HideCredential setting, effectively exposing sensitive credentials.

The vulnerability allows unauthorized disclosure of plaintext API keys belonging to other applications within APIPark. This exposure can lead to unauthorized access to those applications' APIs, potentially compromising data confidentiality and integrity. The impact is limited to users who are authenticated and have authorization-view permission, but the exposure of API keys is a significant security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authorization-view permissions strictly to trusted users and monitor access to the /api/v1/app/authorization endpoint. Avoid sharing authorization UUIDs and consider additional access controls to limit exposure.