Live › vulnerability › CVE-2026-111680
Go to dashboardAPIPark through 1.9.7-beta, an AI gateway, lets an authenticated team manager pass another team's id in the team query parameter. An attacker can then read, modify or delete other teams' services and applications through the service and app API endpoints.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running APIPark through 1.9.7-beta where more than one team shares an instance and some users hold the team manager role. A single-team deployment with no team managers other than trusted admins is exposed much less, since the bypass needs a manager account in one team to reach another team's data.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| APIPark | github | <= 1.9.7-beta | – |
1.9.7-beta is affected1.9.7-beta and earlier affected; no vendor advisory found)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.
This page as .md · .json · in your agent: get_signal("CVE-2026-111680")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.