CVE-2026-64859— New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
Quick assessment
Affected
QuantumNous new-api
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
QuantumNous New API是QuantumNous个人开发者的一个LLM网关和AI资产管理系统。 QuantumNous New API 1.0.0-rc.7之前版本存在信息泄露漏洞，该漏洞源于管理用户列表和用户查询API（包括GET /api/user/）在查询使用Omit("password")后序列化User模型对象，将User.AccessToken作为access_token返回，可能导致已认证管理员获取root用户的bearer token并访问root专用系统配置API。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| QuantumNous | new-api | < 1.0.0-rc.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-64859
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
QuantumNous New API 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
QuantumNous New API是QuantumNous个人开发者的一个LLM网关和AI资产管理系统。 QuantumNous New API 1.0.0-rc.7之前版本存在信息泄露漏洞，该漏洞源于管理用户列表和用户查询API（包括GET /api/user/）在查询使用Omit("password")后序列化User模型对象，将User.AccessToken作为access_token返回，可能导致已认证管理员获取root用户的bearer token并访问root专用系统配置API。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| QuantumNous | new-api | < 1.0.0-rc.7 | - |
|
II. Public POCs for CVE-2026-64859
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 7877 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-64859
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-64859 (1)
-
🔗 Page not found · GitHub · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-64859 (1)
Vendor Pages for CVE-2026-64859 (1)
-
🔗 Release v1.0.0-rc.7 · QuantumNous/new-api · GitHub x_refsource_MISC
Same Patch Batch · QuantumNous · 2026-08-17 · 5 CVEs total
| CVE-2026-71479 | 9.1 CRITICAL | New API: Integer overflow in quota billing yields negative charges (self-crediting) |
| CVE-2026-64868 | 7.5 HIGH | New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body rea |
| CVE-2026-64865 | 6.0 MEDIUM | New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass |
| CVE-2026-64866 | 5.1 MEDIUM | New API: Admin can reset passkeys for same-level or higher-privileged users |
IV. Related Vulnerabilities
Same product: new-api
-
CVE-2026-64865
New API: Redis user quota cache overwrite via PUT /api/user/ -
CVE-2026-71479
New API: Integer overflow in quota billing yields negative c -
CVE-2026-64866
New API: Admin can reset passkeys for same-level or higher-p -
CVE-2026-64868
New API: Unauthenticated payment webhooks allow memory and d -
CVE-2026-44342
New API CSRF in email and WeChat account binding endpoints
Same vendor: QuantumNous
-
CVE-2026-64865
New API: Redis user quota cache overwrite via PUT /api/user/ -
CVE-2026-71479
New API: Integer overflow in quota billing yields negative c -
CVE-2026-64866
New API: Admin can reset passkeys for same-level or higher-p -
CVE-2026-64868
New API: Unauthenticated payment webhooks allow memory and d -
CVE-2026-44342
New API CSRF in email and WeChat account binding endpoints
Same weakness: CWE-200
-
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-56380
AVideo feed/index.php Exposure of Channel Owner Email Addres -
CVE-2026-48050
Arc: Unauthenticated access to Go debug pprof endpoints leak -
CVE-2026-34948
Combodo iTop: Access control bypass via OQL joins -
CVE-2026-53497
CrossWatch: Unauthenticated /api/app-auth/status endpoint le
V. Comments for CVE-2026-64859
No comments yet