Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M
CVE-2026-30886New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in new-api from QuantumNous. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (`GET /v1/videos/:task_id/content`) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — `model.GetByOnlyTaskId(taskID)` queries by `task_id` alone with no `user_id` filter, while every other task-lookup in the codebase enforces ownership via `model.GetByTaskId(userId, taskID)`. Version 0.11.4-alpha.2 contains a patch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/QuantumNous/new-api | 0.11.4-alpha.2 | GHSA-f35r-v9x5-r8mc |
| Go | github.com/QuantumNous/new-api | 0.11.4-alpha.2 | GO-2026-4814 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QuantumNous | new-api | < 0.11.4-alpha.2 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N