{"data":{"id":"336deade-8b00-412a-83c0-44313f232ff8","title":"CVE-2026-30886: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to…","summary":"New API, an LLM gateway and AI asset management system, is vulnerable before version 0.11.4-alpha.2. An Insecure Direct Object Reference in the GET /v1/videos/:task_id/content endpoint lets any authenticated user access other users' video content. The server also authenticates to upstream providers (Google Gemini, OpenAI) using credentials derived from tasks the attacker does not own. The cause is that model.GetByOnlyTaskId(taskID) queries by task_id alone, without a user_id filter.","solution":"Fixed in version 0.11.4-alpha.2, which contains a patch.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-30886","publishedAt":"2026-03-23T20:16:25.963Z","cveId":"CVE-2026-30886","cweIds":["CWE-639"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/QuantumNous/new-api@< 0.11.4-alpha.2 (fixed: 0.11.4-alpha.2)"],"affectedPackageNames":["github.com/quantumnous/new-api"],"affectedPackageRefs":["go:github.com/quantumnous/new-api"],"affectedVendors":["OpenAI","Google"],"affectedVendorsRaw":["New API","Google Gemini","OpenAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"New API video proxy endpoint IDOR exposes other users' video content","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00279,"epssCheckedAt":"2026-11-09T12:10:44.456Z","kevDateAdded":null,"advisoryAliases":["GHSA-f35r-v9x5-r8mc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:19.081Z","patchAvailable":true,"disclosureDate":"2026-03-23T20:16:25.963Z","fixReleasedAt":"2026-03-06T14:33:51.000Z","daysToFix":-17,"fixCheckedAt":"2026-10-29T21:39:42.160Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/QuantumNous/new-api","fixedVersion":"0.11.4-alpha.2","matchedVersion":"v0.11.4-alpha.2","fixReleasedAt":"2026-03-06T14:33:51.000Z","daysToFix":-17,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:42.014Z"}]}}