Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-111680

APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Apiparklab
Products
Apipark
CVE-2026-108862

APIPark through 1.9.7-beta IDOR via application authorization endpoints

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Apiparklab
Products
Apipark