Read the docs
TI-2026-23715 Aliases CVE-2026-30886GHSA-f35r-v9x5-r8mc

New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

Priority MEDIUM 62CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (`GET /v1/videos/:task_id/content`) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — `model.GetByOnlyTaskId(taskID)` queries by `task_id` alone with no `user_id` filter, while every other task-lookup in the codebase enforces ownership via `model.GetByTaskId(userId, taskID)`. Version 0.11.4-alpha.2 contains a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed new-api (QuantumNous): 0.11.4-alpha.2github.com/QuantumNous/new-api (Go): 0.11.4-alpha.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QuantumNousnew-apibefore 0.11.4-alpha.20.11.4-alpha.2Patch availableCNA
—github.com/QuantumNous/new-api (Go)before 0.11.4-alpha.20.11.4-alpha.2Patch availableGHSA-f35r-v9x5-r8mc
  • new-api VendorQuantumNous Affected before 0.11.4-alpha.2 Fixed in 0.11.4-alpha.2 Patch available CNA
  • github.com/QuantumNous/new-api (Go) Vendor— Affected before 0.11.4-alpha.2 Fixed in 0.11.4-alpha.2 Patch available GHSA-f35r-v9x5-r8mc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:*before 0.11.4VulnerableQuantumNous
cpe:2.3:a:newapi:new_api:0.11.4:alpha1:*:*:*:*:*:*0.11.4 alpha1VulnerableQuantumNous
  • cpe:2.3:a:newapi:new_api:*:*:*:*:*:*:*:* Versions before 0.11.4 Vulnerable ·QuantumNous
  • cpe:2.3:a:newapi:new_api:0.11.4:alpha1:*:*:*:*:*:* Versions 0.11.4 alpha1 Vulnerable ·QuantumNous

Remediation

  • Fix · CNA new-api (QuantumNous) Fixed in 0.11.4-alpha.2
  • Fix · GHSA-f35r-v9x5-r8mc github.com/QuantumNous/new-api (Go) Fixed in 0.11.4-alpha.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30886
  2. 2026-10-03 Alias added: GHSA-f35r-v9x5-r8mc

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2025-35042 QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1HIGH 8.8
  • TI-2026-30643 New API: SSRF Filter Bypass via 0.0.0.0 CVSS 4.0HIGH 7.1
  • TI-2026-30031 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud CVSS 3.1HIGH 8.2
  • TI-2026-20865 New API has Potential XSS in its MarkdownRenderer component CVSS 3.1HIGH 7.6
  • TI-2026-20698 New API has an SQL LIKE Wildcard Injection DoS via Token Search CVSS 4.0HIGH 7.1
  • TI-2026-26035 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs CVSS 3.1HIGH 7.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences