CVE-2026-64865: QuantumNous new-api Redis quota cache race condition in user settings update

Executive brief

An authenticated user can bypass usage quota enforcement by repeatedly updating account settings (language or sidebar preferences) via the PUT /api/user/self endpoint. This race condition allows the user's cached quota balance to be artificially inflated, permitting API calls far beyond what they have paid for and causing direct financial loss to service operators.

Technical details

This is a race condition (CWE-362) in the user quota caching layer. The vulnerable code path in controller/user.go's UpdateSelf function reads a full User object snapshot and writes it back through User.Update(), which includes stale quota data. The cache refresh via RedisHSetObj performs a full hash overwrite on the Redis user cache, including the Quota field. Meanwhile, normal billing operations atomically decrement quota using Redis HINCRBY commands. An attacker can race repeated PUT /api/user/self calls against quota consumption, causing stale Quota values to overwrite the decremented balance. The vulnerability requires authentication and a Redis-backed quota cache enabled, but no special privileges or user interaction. The fix in v1.0.0-rc.16 makes user setting updates field-scoped, prevents stale snapshots from overwriting accounting fields, and reserves quota cache updates for atomic quota delta or explicit synchronization paths.

Affected products

• QuantumNous new-api <= 1.0.0-rc.15

Timeline

• 2026-08-07: disclosed
• 2026-08-17: patched: Fixed in v1.0.0-rc.16

References

• https://api.github.com/users/lihui12388
• https://github.com/lihui12388
• https://api.github.com/users/lihui12388/gists%7B/gist_id%7D
• https://api.github.com/users/lihui12388/repos
• https://avatars.githubusercontent.com/u/32051199?v=4
• https://api.github.com/users/lihui12388/events%7B/privacy%7D