CVE-2026-64865Medium▾ SunlitNew API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because co…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/QuantumNous/new-api <= 1.0.0-rc.15Patched in:
github.com/QuantumNous/new-api 1.0.0-rc.16Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64859Critical· 9.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-64868High· 7.5New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-64866MediumNew API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-71479Critical· 9.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-33655High· 7.7New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
CVE-2026-44342Medium· 5.3New API is vulnerable to CSRF through user email binding