CVE-2026-64866 json
New API: Admin can reset passkeys for same-level or higher-privileged users
published 2026-08-17 2 mo ago modified 2026-09-18 51 d ago also EUVD-2026-60261 , GHSA-p845-629j-rcj6 , GO-2026-6244
- cvss
- 5.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.
Patch / fix
- go github.com/QuantumNous/new-api 1.0.0-rc.7
- newapi new_api 1.0.0-rc.7
- govulncheck-vulndb SLES for SAP applications 16.0, SLES 16.0 0.0.20260827T195228-160000.1.1
suse advisories SUSE-SU-2026:23625-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260827T195228-160000.1.1
opensuse advisories openSUSE-SU-2026:21761-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/QuantumNous/new-api | >=0.9.1.3, <1.0.0-rc.7 <1.0.0-rc.7 |
1.0.0-rc.7 |
Affected products
- QuantumNous new-api
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/QuantumNous/new-api/pull/4929
web, patch
-
github.com
/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3
web, patch
-
github.com
/QuantumNous/new-api/security/advisories/GHSA-p845-629j-rcj6
web, advisory
-
github.com
/QuantumNous/new-api/releases/tag/v1.0.0-rc.7
web
-
github.com
/QuantumNous/new-api
package
Sources
- CVE List CVE-2026-64866
- GitHub Advisory GHSA-p845-629j-rcj6
- NVD CVE-2026-64866
- OSV GO-2026-6244
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.