CVE-2026-64866CWE-862broken-access-control

CVE-2026-64866

published August 17, 2026

CVSS
5.1
EPSS
0%
Percentile
39.9
In the wild
Unconfirmed
What it is

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00473 · 39.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-17T20:17Z
References (4)
https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3 · [email protected]https://github.com/QuantumNous/new-api/pull/4929 · [email protected]https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7 · [email protected]https://github.com/QuantumNous/new-api/security/advisories/GHSA-p845-629j-rcj6 · [email protected]
EPSS history
Timeline
  • 17 AUG 16:06Z
    New API: Admin can reset passkeys for same-level or higher-privileged users
    cvelistv5