{"id":"CVE-2026-111680","kind":"vulnerability","aliases":["CVE-2026-111680"],"related":[],"title":"APIPark: team managers can read and change other teams' services and apps","description":"APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.","summary":"APIPark through 1.9.7-beta, an AI gateway, lets an authenticated team manager pass another team's id in the team query parameter. An attacker can then read, modify or delete other teams' services and applications through the service and app API endpoints.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"APIPark","fixed":[],"affected":"<= 1.9.7-beta","ecosystem":"github"}],"ecosystems":[],"tags":["ai-gateway","ai-tooling","apipark","authz-bypass","multi-tenant","self-hosted"],"not_affected_if":["no-team-managers","no-untrusted-team-managers","single-team","single-team-deployment"],"how_to_check":"Run APIPark version check; <= 1.9.7-beta is affected. Test with two teams: as a manager of team A, call GET /api/v1/service/info?service=<team B service id>&team=<A id>; a 200 with team B's data confirms exposure. Review access logs for these routes with mismatched team/service pairs.","fix":"No fixed version published as of 2026-10-25 (1.9.7-beta and earlier affected; no vendor advisory found). Until then: limit team manager role to trusted users, restrict access to the management API/UI to trusted networks, and log or block requests to /api/v1/service/info and /api/v1/app where the team param is not the caller's own team or the object belongs to another team.","status":"open","published_at":"2026-10-16T18:17:50+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:02:34+00:00","updated_at":"2026-10-25T03:14:05+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T03:02:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"APIPark: team managers can read and change other teams' services and apps","impact":"high","summary":"APIPark through 1.9.7-beta, an AI gateway, lets an authenticated team manager pass another team's id in the team query parameter. An attacker can then read, modify or delete other teams' services and applications through the service and app API endpoints.","category":"ai-tooling","nicknames":[],"who_cares":["apipark","self-hosted","ai-gateway","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"Team manager reads, changes or deletes other teams' services and apps","analyst_note":"Check the NVD entry and the APIPark project for a fixed release version and any patch or advisory; the sources give no fix version.","how_to_check":"- Check the installed APIPark version; the sources say the flaw affects `1.9.7-beta` and earlier.\n- Confirm whether team managers can call `/api/v1/service/info` and `/api/v1/app` with a `team` parameter for a team they do not belong to.","needs_analyst":true,"not_affected_if":["single-team-deployment","no-team-managers"],"who_is_affected":"Teams running APIPark through 1.9.7-beta where more than one team shares an instance and some users hold the team manager role. A single-team deployment with no team managers other than trusted admins is exposed much less, since the bypass needs a manager account in one team to reach another team's data.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3360,"output_tokens":539,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the APIPark project for a fixed release version and any patch or advisory; the sources give no fix version.","search":"'-111680':15A,18A '-2026':14A,17A '/api/v1/app':135C '/api/v1/service/info':133C '/api/v1/simple/apps':121C '/api/v1/simple/services':119C '1.9.7':38B,80C 'access':93C 'ai':21B,24B,41B 'ai-gateway':20B 'ai-tool':23B 'allow':88C 'anoth':49B 'api':76B 'apipark':1A,19A,26B,36B,78C 'app':12A,75B,115C 'applic':70B,98C,131C 'attack':59B,110C 'authent':45B,89C 'author':84C 'authz':28B 'authz-bypass':27B 'beta':39B,81C 'bypass':29B,85C 'chang':7A 'contain':82C 'cve':13A,16A 'delet':65B,126C 'endpoint':77B,136C 'expos':117C 'gateway':22B,42B 'host':35B 'id':52B,104C,116C 'let':43B 'manag':3A,47B,91C 'modifi':63B,124C 'multi':31B 'multi-ten':30B 'paramet':57B,109C 'pass':48B 'queri':56B,108C 'read':5A,62B,123C 'self':34B 'self-host':33B 'servic':10A,68B,73B,96C,113C,129C 'suppli':100C 'target':112C 'team':2A,9A,46B,50B,55B,67B,90C,95C,103C,107C,128C 'tenant':32B 'tool':25B 'via':132C 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Teams running APIPark through 1.9.7-beta where more than one team shares an instance and some users hold the team manager role. A single-team deployment with no team managers other than trusted admins is exposed much less, since the bypass needs a manager account in one team to reach another team's data.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111680","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111680","severity":null,"published_at":"2026-10-16T18:17:50+00:00","modified_at":"2026-10-19T14:16:59+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111680:675","url":null,"severity":null,"published_at":"2026-10-25T03:14:05+00:00","modified_at":"2026-10-25T03:14:05+00:00","first_seen_at":"2026-10-25T03:14:05+00:00","fetched_at":"2026-10-25T03:14:05+00:00","note":"No vendor advisory or fixed release found; latest release page shows no fix, 1.9.7-beta is latest at disclosure per Armis. Root cause from reporter writeup (hackmd) and VulnCheck: permit middleware reads ?team= from query and checks caller role in that team, while object routes are keyed by service/app id with no owner check. No PoC executed by reporter; no exploitation seen. Nothing marked verified."}],"documents":[{"id":3073,"url":"https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass","title":"APIPark team-scope authorization bypass (reporter writeup, hieuPenguinnn)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3074,"url":"https://www.vulncheck.com/advisories/apipark-through-1.9.7-beta-cross-team-authorization-bypass-via-team-query-parameter","title":"VulnCheck advisory: APIPark <= 1.9.7-beta cross-team authz bypass","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3076,"url":"https://github.com/APIParkLab/APIPark/releases","title":"APIPark releases (no fix listed)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}