CVE Intelligence

APIParkLab vulnerabilities

🔔 Create alert RSS

Published CVEs affecting APIParkLab products: 1 record(s), with severity, exploitation and fixes.

APIPark 1

Exploited only (KEV) →

CVE-2026-108862 Medium · 5.3 CWE-639 Oct 11, 2026
APIPark through 1.9.7-beta IDOR via application authorization endpoints
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.