Apipark
Monthly
Cross-team authorization bypass in APIPark through 1.9.7-beta allows an authenticated team manager to read, modify, and delete services and applications belonging to other teams by supplying their own team identifier in the 'team' query parameter to /api/v1/service/info and /api/v1/app. Exploitation requires a valid team-manager account on an instance configured with multiple teams; the attacker first enumerates foreign service and app IDs via /api/v1/simple/services and /api/v1/simple/apps, and no user interaction or non-default settings are needed. The vendor CVSS 4.0 base score is 7.2 (High) with low confidentiality and high integrity/availability impact on other teams' resources, and no public exploit identified at time of analysis, though a public technical writeup documenting the bypass exists.
Authenticated APIPark users who hold authorization-view permission on even one application can read another application's plaintext API keys by supplying a foreign authorization UUID to /api/v1/app/authorization or its details route, and the exposure occurs regardless of the HideCredential setting. The flaw affects APIPark through 1.9.7-beta and is a genuine but moderate-severity authorization issue (CVSS 6.0, CWE-639) rather than an emergency: the attacker must already be authenticated with the required permission and must possess or guess another tenant's non-sequential UUID, which meaningfully limits opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Cross-team authorization bypass in APIPark through 1.9.7-beta allows an authenticated team manager to read, modify, and delete services and applications belonging to other teams by supplying their own team identifier in the 'team' query parameter to /api/v1/service/info and /api/v1/app. Exploitation requires a valid team-manager account on an instance configured with multiple teams; the attacker first enumerates foreign service and app IDs via /api/v1/simple/services and /api/v1/simple/apps, and no user interaction or non-default settings are needed. The vendor CVSS 4.0 base score is 7.2 (High) with low confidentiality and high integrity/availability impact on other teams' resources, and no public exploit identified at time of analysis, though a public technical writeup documenting the bypass exists.
Authenticated APIPark users who hold authorization-view permission on even one application can read another application's plaintext API keys by supplying a foreign authorization UUID to /api/v1/app/authorization or its details route, and the exposure occurs regardless of the HideCredential setting. The flaw affects APIPark through 1.9.7-beta and is a genuine but moderate-severity authorization issue (CVSS 6.0, CWE-639) rather than an emergency: the attacker must already be authenticated with the required permission and must possess or guess another tenant's non-sequential UUID, which meaningfully limits opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis.