Multiple vulnerabilities affecting github.com/QuantumNous/new-api have been identified. The flaws include sensitive information disclosure, privilege escalation, denial-of-service conditions, authorization bypass, and quota enforcement bypass. The vulnerabilities could allow attackers to obtain privileged access tokens, impersonate higher-privileged users, disrupt service availability, weaken authentication protections, and bypass usage restrictions, potentially resulting in unauthorized system control and operational impact.
CVE-2026-64859 (CVSS 9.1 — Critical): In affected versions of new-api, the admin user list and user lookup APIs can return the access_token field for users, including the root user. An authenticated admin user can call endpoints such as / to retrieve user records, resulting in privilege escalation.[/subscribe_to_unlock_form]
Multiple vulnerabilities affecting github.com/QuantumNous/new-api have been identified. The flaws include sensitive information disclosure, privilege escalation, denial-of-service conditions, authorization bypass, and quota enforcement bypass. The vulnerabilities could allow attackers to obtain privileged access tokens, impersonate higher-privileged users, disrupt service availability, weaken authentication protections, and bypass usage restrictions, potentially resulting in unauthorized system control and operational impact.
CVE-2026-64859 (CVSS 9.1 — Critical): In affected versions of new-api, the admin user list and user lookup APIs can return the access_token field for users, including the root user. An authenticated admin user can call endpoints such as / to retrieve user records, resulting in privilege escalation.[emaillocker id="1283"]
CVE-2026-64868 (CVSS 7.5 — High): Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. This issue allowed an unauthenticated attacker to send oversized requests to public callback endpoints and force excessive memory use and log growth.
CVE-2026-64866 (CVSS 5.1 — Medium): The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints, allowing lower-privileged administrators to perform passkey reset operations against same-level or higher-privileged users, including root-level accounts, potentially weakening authentication protections and account security boundaries.
CVE-2026-64865 (CVSS 6.0 — Medium): A quota bypass vulnerability allowed authenticated low-privileged users to repeatedly call /api/user/self through user setting updates, exploiting Redis quota synchronization issues to bypass usage limits, enabling excessive API consumption beyond assigned quotas and potentially causing financial impact.
The following reports contain further technical details:
https://github.com/advisories/GHSA-6x2c-phff-wx57
https://github.com/advisories/GHSA-v828-m3pf-vq9q
https://github.com/advisories/GHSA-p845-629j-rcj6
https://github.com/advisories/GHSA-j6gc-4893-qwmp