# CVE-2026-64865: QuantumNous new-api Redis quota cache race condition in user settings update

Source: https://junglewise.ai/threats/cve-2026-64865-quantumnous-new-api-redis-quota-cache-race-condition-in-user  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-64865 · Severity: medium · CVSS 4 · Published 2026-08-17

An authenticated user can bypass usage quota enforcement by repeatedly updating account settings (language or sidebar preferences) via the PUT /api/user/self endpoint. This race condition allows the user's cached quota balance to be artificially inflated, permitting API calls far beyond what they have paid for and causing direct financial loss to service operators.

Technologies: [github.com/QuantumNous/new-api (Go)](https://junglewise.ai/threats/technologies/github-com-quantumnous-new-api), [QuantumNous New API](https://junglewise.ai/threats/technologies/new-api). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [QuantumNous](https://junglewise.ai/threats/vendors/quantumnous).

## Quick answers

**Is CVE-2026-64865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64865 being exploited in the wild.

**How severe is CVE-2026-64865?** Medium severity, with a CVSS score of 4, published 17 August 2026.

**Which products and versions are affected?** github.com/QuantumNous/new-api (Go) <= 1.0.0-rc.15, SEMVER:introduced=0,fixed=1.0.0-rc.16; QuantumNous New API <= 1.0.0-rc.15.

**Is there a fix for CVE-2026-64865?** Yes. github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64865 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-64865?** Check whether you run github.com/QuantumNous/new-api (Go) or QuantumNous New API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/QuantumNous/new-api (Go): upgrade to 1.0.0-rc.16 or later

  ```sh
  go get github.com/QuantumNous/new-api@v1.0.0-rc.16
  ```


## Technical details

This is a race condition (CWE-362) in the user quota caching layer. The vulnerable code path in controller/user.go's UpdateSelf function reads a full User object snapshot and writes it back through User.Update(), which includes stale quota data. The cache refresh via RedisHSetObj performs a full hash overwrite on the Redis user cache, including the Quota field. Meanwhile, normal billing operations atomically decrement quota using Redis HINCRBY commands. An attacker can race repeated PUT /api/user/self calls against quota consumption, causing stale Quota values to overwrite the decremented balance. The vulnerability requires authentication and a Redis-backed quota cache enabled, but no special privileges or user interaction. The fix in v1.0.0-rc.16 makes user setting updates field-scoped, prevents stale snapshots from overwriting accounting fields, and reserves quota cache updates for atomic quota delta or explicit synchronization paths.

## Affected products

- QuantumNous new-api <= 1.0.0-rc.15

## Identifiers

- CVE-2026-64865
- GHSA-j6gc-4893-qwmp
- GO-2026-6243

## Timeline

- 2026-08-07: disclosed
- 2026-08-17: patched: Fixed in v1.0.0-rc.16

## References

- [https://api.github.com/users/lihui12388](https://api.github.com/users/lihui12388)
- [https://github.com/lihui12388](https://github.com/lihui12388)
- [https://api.github.com/users/lihui12388/gists%7B/gist_id%7D](https://api.github.com/users/lihui12388/gists%7B/gist_id%7D)
- [https://api.github.com/users/lihui12388/repos](https://api.github.com/users/lihui12388/repos)
- [https://avatars.githubusercontent.com/u/32051199?v=4](https://avatars.githubusercontent.com/u/32051199?v=4)
- [https://api.github.com/users/lihui12388/events%7B/privacy%7D](https://api.github.com/users/lihui12388/events%7B/privacy%7D)

## Related threats

- [QuantumNous new-api session expiration in Revoked API Token Handler](https://junglewise.ai/threats/cve-2026-82909-quantumnous-new-api-session-expiration-in-revoked-api-token)
- [QuantumNous New API integer overflow in quota billing](https://junglewise.ai/threats/cve-2026-71479-quantumnous-new-api-integer-overflow-in-quota-billing)
- [QuantumNous new-api unauthenticated payment webhook denial of service](https://junglewise.ai/threats/cve-2026-64868-quantumnous-new-api-unauthenticated-payment-webhook-denial-of)
- [QuantumNous new-api admin passkey reset privilege escalation](https://junglewise.ai/threats/cve-2026-64866-quantumnous-new-api-admin-passkey-reset-privilege-escalation)
- [New API user list API information disclosure and privilege escalation](https://junglewise.ai/threats/cve-2026-64859-new-api-user-list-api-information-disclosure-and-privilege)