CVE-2026-30886

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-30886
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30886.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-30886
Aliases
Downstream
Related
Published
2026-03-23T19:18:34.150Z
Modified
2026-04-10T05:41:57.375460Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
Details

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (GET /v1/videos/:task_id/content) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — model.GetByOnlyTaskId(taskID) queries by task_id alone with no user_id filter, while every other task-lookup in the codebase enforces ownership via model.GetByTaskId(userId, taskID). Version 0.11.4-alpha.2 contains a patch.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30886.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/quantumnous/new-api

Affected ranges

Type
GIT
Repo
https://github.com/quantumnous/new-api
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8d7d880db5c9d59901ac663ef433e6e8244568ba
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.11.4-alpha.2"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30886.json"