APIPark CVE-2026-111680

Requires a valid authenticated account with team-manager privileges on an APIPark instance at or below 1.9.7-beta operating in a multi-team configuration. The attacker first enumerates other teams' service and app IDs via /api/v1/simple/services and /api/v1/simple/apps, then supplies their own team id in the 'team' query parameter when calling /api/v1/service/info and /api/v1/app, which the server fails to validate against resource ownership. Limiting factors: exploitation is impossible without authenticated team-manager access (not fully unauthenticated), and the impact only matters where multiple distinct teams share one instance; no user interaction or non-default settings are required, and it works against the default configuration.

This is a cross-tenant authorization bypass (IDOR, CWE-639) with a vendor-supplied CVSS 4.0 base score of 7.2 (High). The vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation requiring no user interaction, but PR:L confirms the attacker must already hold a valid authenticated team-manager account - so this is an insider/compromised-credential threat within a multi-team deployment, not an unauthenticated internet-wide drive-by. Impact is asymmetric: VC:L (limited confidentiality - attacker reads other teams' service/app data) but VI:H and VA:H, meaning cross-team modification and deletion of services and applications are the dominant risks (tenant-isolation and data-integrity/availability failure). No EPSS score, no CISA KEV listing, and no explicit POC flag were provided in the input; however, the references include a detailed public technical writeup (hackmd) and direct links to the exact vulnerable source lines (permit/team/iml.go, plugins/core/service.go), which document the precise endpoints and the team-id parameter needed to reproduce the bypass, materially lowering the barrier to exploitation even though no packaged exploit tool is cited. Overall this is a genuine priority for organizations running APIPark in shared multi-team mode, but the PR:L authentication requirement meaningfully narrows the attacker population versus the raw score alone. Note VC:L (not H) indicates confidentiality exposure is partial, so the real danger is unauthorized tampering/destruction rather than bulk data theft.

A low-privileged user who manages their own team in a shared APIPark instance calls /api/v1/simple/services and /api/v1/simple/apps to harvest service and app IDs belonging to other teams, then re-submits those IDs while passing their own team id in the team query parameter to /api/v1/service/info and /api/v1/app. Because the server trusts the user-controlled team parameter instead of enforcing ownership, the attacker can read, alter, or delete another team's services and applications. No packaged exploit is cited, but a public technical writeup documents the exact endpoints and parameters.