APIParkLab APIPark vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting APIParkLab APIPark: 1 record(s), with affected versions and fixes.

CVE-2026-108862 Medium · 5.3 CWE-639 Oct 11, 2026

APIPark through 1.9.7-beta IDOR via application authorization endpoints

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.