---
id: "CVE-2026-111680"
kind: "vulnerability"
aliases: ["CVE-2026-111680"]
title: "APIPark: team managers can read and change other teams' services and apps"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "APIPark", "fixed": [], "affected": "<= 1.9.7-beta", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-gateway", "ai-tooling", "apipark", "authz-bypass", "multi-tenant", "self-hosted"]
not_affected_if: ["no-team-managers", "no-untrusted-team-managers", "single-team", "single-team-deployment"]
published_at: "2026-10-16T18:17:50+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:14:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111680", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:14:05+00:00"}]
---

# APIPark: team managers can read and change other teams' services and apps

APIPark through 1.9.7-beta, an AI gateway, lets an authenticated team manager pass another team's id in the team query parameter. An attacker can then read, modify or delete other teams' services and applications through the service and app API endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:APIPark affected <= 1.9.7-beta fixed ?

## How to check

Run APIPark version check; <= 1.9.7-beta is affected. Test with two teams: as a manager of team A, call GET /api/v1/service/info?service=<team B service id>&team=<A id>; a 200 with team B's data confirms exposure. Review access logs for these routes with mismatched team/service pairs.

## Fix

No fixed version published as of 2026-10-25 (1.9.7-beta and earlier affected; no vendor advisory found). Until then: limit team manager role to trusted users, restrict access to the management API/UI to trusted networks, and log or block requests to /api/v1/service/info and /api/v1/app where the team param is not the caller's own team or the object belongs to another team.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111680
- 2026-10-25T03:14:05+00:00 analyst — No vendor advisory or fixed release found; latest release page shows no fix, 1.9.7-beta is latest at disclosure per Armis. Root cause from reporter writeup (hackmd) and VulnCheck: permit middleware reads ?team= from query and checks caller role in that team, while object routes are keyed by service/app id with no owner check. No PoC executed by reporter; no exploitation seen. Nothing marked verified.

## Documents

- [advisory] VulnCheck advisory: APIPark <= 1.9.7-beta cross-team authz bypass https://www.vulncheck.com/advisories/apipark-through-1.9.7-beta-cross-team-authorization-bypass-via-team-query-parameter
- [describes] APIPark team-scope authorization bypass (reporter writeup, hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/apipark-cross-team-service-app-authz-bypass
- [mentions] APIPark releases (no fix listed) https://github.com/APIParkLab/APIPark/releases

## From the sources

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_