CVE-2026-64865

UNKNOWN 0.0

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.

CWE	CWE-362
Vendor	quantumnous
Product	new-api
Published	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for quantumnous new-api

Be the first to know when new unknown vulnerabilities affecting quantumnous new-api are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

QuantumNous / new-api

< 1.0.0-rc.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp github.com: https://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f github.com: https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16