Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

New API exposes admin token allowing full system control

CVE-2026-64859 · published 1 month ago
Summary

Versions of New API before 1.0.0-rc.7 return the root user's access token when an administrator asks for the user list. With that token, a signed‑in administrator can act as the root user and change any setting. Update to version 1.0.0-rc.7 or later and regenerate any tokens that may have been exposed.

What to do
  • Update github.com quantumnous to version 1.0.0-rc.7.
Affected software
Ecosystem VendorProductAffected versions
– quantumnous new-api < 1.0.0-rc.7
go github.com quantumnous < 1.0.0-rc.7
Fix: upgrade to 1.0.0-rc.7
Original advisory text
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.
References
Severity
9.1 Critical
CVSS 3.1: 9.1 (NVD)
Exploitation
EPSS <1%
Type
CWE-200Information Exposure
Timeline
Published17 Aug 2026
Updated25 Sep 2026
First seen17 Aug 2026
Sources
CVE-2026-64859 · NVD
CVE-2026-64859 · MITRE
GHSA-6x2c-phff-wx57 · GHSA
CVE-2026-64859 · OSV
Track software like this
Free during beta