CVE-2026-111680: APIPark 0 through 1.9.7-beta

Affected technology

APIPark · 0 through 1.9.7-beta
APIParkLab

Description’s affected range: through 1.9.7-beta

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality impact as low; integrity and availability impact as high.