CVE-2026-30886
Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (GET /v1/videos/:task_id/content) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — model.GetByOnlyTaskId(taskID) queries by task_id alone with no user_id filter, while every other task-lookup in the codebase enforces ownership via model.GetByTaskId(userId, taskID). Version 0.11.4-alpha.2 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/QuantumNous/new-apiGo | < 0.11.4-alpha.2 | 0.11.4-alpha.2 |
Affected products
6- ghsa-coords3 versionspkg:golang/github.com/quantumnous/new-apipkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 0.11.4-alpha.2+ 2 more
- (no CPE)range: < 0.11.4-alpha.2
- (no CPE)range: < 0.0.20260326T203309-150000.1.155.2
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- Range: < 0.11.4-alpha.2
Patches
Vulnerability mechanics
References
4- github.com/QuantumNous/new-api/commit/50ec2bac6b341e651fc9ac4344e3bd2cdaeafdbdnvdPatchWEB
- github.com/QuantumNous/new-api/security/advisories/GHSA-f35r-v9x5-r8mcnvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-f35r-v9x5-r8mcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30886ghsaADVISORY
News mentions
0No linked articles in our index yet.