Executive brief
new-api is an API management platform used to handle user accounts and system configuration. Affected versions leak API authentication tokens for admin and root users through user lookup endpoints, allowing an authenticated admin to impersonate the root user and gain unrestricted access to sensitive system settings, payment configuration, and other administrative functions. This represents a complete bypass of intended access control and requires immediate upgrade to patch.
Technical details
The vulnerability is an information disclosure and privilege escalation in the user management APIs of new-api. The root cause is improper JSON serialization: the User.AccessToken field was tagged with json:"access_token", causing access tokens to be serialized in API responses. User list, search, and detail endpoints returned User model objects with only the password field omitted (via Omit("password")), leaving access_token unfiltered. An authenticated admin user can call GET /api/user/ to retrieve user records containing access tokens for other users, including the root user. Because access tokens serve as bearer credentials for API authentication, obtaining the root user's token allows the attacker to authenticate as root and access root-only endpoints for system configuration, payment settings, and OAuth/SMTP configuration. The fix (available in v1.0.0-rc.7) changes the field tag to json:"-" to prevent serialization.
Affected products
- QuantumNous new-api before v1.0.0-rc.7
Timeline
- 2026-07-03: disclosed
- 2026-08-17: advisory: GitHub Advisory Database published
- 2026-07-03: patched: Fixed in v1.0.0-rc.7 (commit 0936e25)