CVSS 4.0
5.1 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2026-64866
Medium (5.1). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/QuantumNous/new-api 1.0.0-rc.7.
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p845-629j-rcj6 | Go | github.com/QuantumNous/new-api | >=0.9.1.3 <1.0.0-rc.7 | 1.0.0-rc.7 |
| GO-2026-6244 | Go | github.com/QuantumNous/new-api | <1.0.0-rc.7 | 1.0.0-rc.7 |