cve.bz

CVE-2026-64865

6.0 mediumEPSS 0.3%

Medium (6.0). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/QuantumNous/new-api 1.0.0-rc.16.

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.

Severity

CVSS 4.0

6.0 medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
CWE
CWE-362
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j6gc-4893-qwmpGogithub.com/QuantumNous/new-api<1.0.0-rc.161.0.0-rc.16
GO-2026-6243Gogithub.com/QuantumNous/new-api<1.0.0-rc.161.0.0-rc.16

References

Check your stackJSON