CVE-2026-64866Medium▾ SunlitNew API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELE…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/QuantumNous/new-api >= 0.9.1.3, < 1.0.0-rc.7Patched in:
github.com/QuantumNous/new-api 1.0.0-rc.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64859Critical· 9.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-64868High· 7.5New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-71479Critical· 9.1New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-64865MediumNew API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
CVE-2026-33655High· 7.7New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
CVE-2026-44342Medium· 5.3New API is vulnerable to CSRF through user email binding