CVE-2026-111680: Authorization Bypass Through User-Controlled Key in APIParkLab APIPark

APIPark through version 1.9.7-beta contains an authorization bypass vulnerability. Authenticated users with team manager privileges can supply a user-controlled team ID in the team query parameter to access services and applications of other teams. Attackers can enumerate service or app IDs via the /api/v1/simple/services and /api/v1/simple/apps endpoints and then read, modify, or delete these resources through the /api/v1/service/info and /api/v1/app endpoints. This vulnerability arises from insufficient authorization checks on the team ID parameter, allowing privilege escalation within the application.

An attacker with authenticated team manager access can bypass authorization controls to access, modify, or delete services and applications belonging to other teams. This compromises data confidentiality, integrity, and availability within the APIPark environment. The vulnerability does not require user interaction and has a network attack vector with low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict team manager privileges to trusted users only and monitor API usage for suspicious activity related to unauthorized team ID parameter manipulation.