Is CVE-2026-108862 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108862?

CVE-2026-108862 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-108862

Description

APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential.