MediumVulnerabilityLLM-specific
CVE-2026-30886: New API video proxy endpoint IDOR exposes other users' video content
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-30886
- Published
- Record updated
- Affected
- github.com/QuantumNous/new-api < 0.11.4-alpha.2
- Fixed in
- 0.11.4-alpha.2
- released March 6, 2026, 17 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
New API, an LLM gateway and AI asset management system, is vulnerable before version 0.11.4-alpha.2. An Insecure Direct Object Reference in the GET /v1/videos/:task_id/content endpoint lets any authenticated user access other users' video content. The server also authenticates to upstream providers (Google Gemini, OpenAI) using credentials derived from tasks the attacker does not own. The cause is that model.GetByOnlyTaskId(taskID) queries by task_id alone, without a user_id filter.
Mitigation
Fixed in version 0.11.4-alpha.2, which contains a patch.
Related items
- HighCVE-2026-110930: Codex Desktop for Windows argument injection via quoted project pathsSame vendor · NVD/CVE Database
- MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
- HighCVE-2026-117560: ATXP Gemini CLI extension OS command injection in runAtxp() via MCP parametersSame vendor · NVD/CVE Database
- HighCVE-2026-107685: req_llm WebSocket streaming client accepts untrusted TLS certificatesSame vendor · NVD/CVE Database
- MediumCVE-2026-113459: TYPO3 OpenAI API key exposed to backend users in page sourceSame vendor · NVD/CVE Database