{"id":"EUVD-2026-60263","enisaUuid":"7f289852-01bc-30ae-bb34-34d579898457","description":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.","datePublished":"Aug 17, 2026, 4:13:37 PM","dateUpdated":"Aug 18, 2026, 2:47:21 PM","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp\nhttps://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f\nhttps://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16\n","aliases":"CVE-2026-64865\nGHSA-j6gc-4893-qwmp\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"92d4ef0a-fc95-34e4-8e37-c49c6c7bb179","product":{"name":"new-api","vendor":{"name":"QuantumNous"}},"product_version":"\u003c 1.0.0-rc.16"}],"enisaIdVendor":[{"id":"c3728150-accd-3487-8875-9d2da146d0fe","vendor":{"name":"QuantumNous"}}],"enisaIdVulnerability":[{"id":"1a8dbb65-b542-37a9-bc8f-577a81b06d0f","vulnerability":{"id":"CVE-2026-64865","description":"New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.","datePublished":"Aug 17, 2026, 4:13:37 PM","dateUpdated":"Aug 18, 2026, 2:47:21 PM","status":"PUBLISHED","baseScore":6.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp\nhttps://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f\nhttps://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16\n","enisa_id":"EUVD-2026-60263\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 11, 2026, 7:20:52 AM","vulnerabilityProduct":[{"id":"395c666e-dfb7-32b0-957a-a054cf2303a5","product":{"name":"new-api","vendor":{"name":"QuantumNous"}},"product_version":"\u003c 1.0.0-rc.16"}],"vulnerabilityVendor":[{"id":"20ae20f6-d273-3f8a-9f5f-0288167dfff3","vendor":{"name":"QuantumNous"}}]}},{"id":"acee7846-0e17-3019-a9b8-b456021b4a17","vulnerability":{"id":"GHSA-j6gc-4893-qwmp","description":"New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass","datePublished":"Aug 17, 2026, 4:36:19 PM","dateUpdated":"Aug 17, 2026, 4:36:19 PM","baseScore":0.0,"references":"https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp\nhttps://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f\nhttps://github.com/QuantumNous/new-api\nhttps://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16\n","enisa_id":"EUVD-2026-60263\n","aliases":"CVE-2026-64865\nGHSA-j6gc-4893-qwmp\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:51:44 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}