cve.bz

CVE-2026-64859

9.1 criticalEPSS 0.6%

Critical (9.1). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in github.com/QuantumNous/new-api 1.0.0-rc.7.

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.

Severity

CVSS 3.1

9.1 critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS
0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE
CWE-200
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-6x2c-phff-wx57Gogithub.com/QuantumNous/new-api<1.0.0-rc.71.0.0-rc.7
GO-2026-6240Gogithub.com/QuantumNous/new-api<1.0.0-rc.71.0.0-rc.7

References

Check your stackJSON