GHSA-p845-629j-rcj6

Source

https://github.com/advisories/GHSA-p845-629j-rcj6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p845-629j-rcj6/GHSA-p845-629j-rcj6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p845-629j-rcj6

Aliases

Published

2026-08-17T16:36:05Z

Modified

2026-08-18T15:11:02Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

New API: Admin can reset passkeys for same-level or higher-privileged users

Details

Summary

The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts.

Impact

If the target account had a passkey configured, a lower-privileged administrator could remove that authentication factor and weaken the target account's protection boundary. The attacker still needed administrator privileges, so the issue is rated Medium.

Affected versions

The vulnerable admin passkey reset behavior was present from the passkey feature introduction in v0.9.1.3 through versions before v1.0.0-rc.7.

Patches

This issue is fixed in v1.0.0-rc.7. The fix adds a canManageTargetRole check to AdminResetPasskey before passkey lookup or deletion, preventing lower-privileged administrators from operating on same-level or higher-privileged users.

Workarounds

If upgrading immediately is not possible, restrict admin access to trusted operators only and block DELETE /api/user/:id/reset_passkey at the reverse proxy or gateway except for root operators.

References

Fixed by commit 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3.
Relevant code paths: controller/passkey.go, controller/twofa.go, and router/api-router.go.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T16:36:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/QuantumNous/new-api

Package

Name: github.com/QuantumNous/new-api; View open source insights on deps.dev
Purl: pkg:golang/github.com/QuantumNous/new-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.9.1.3

Fixed

1.0.0-rc.7

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p845-629j-rcj6/GHSA-p845-629j-rcj6.json"