New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-64865 · CVE overview and exploitation status

EUVD-2026-60263

GHSA-j6gc-4893-qwmp

GO-2026-6243

cve-program · CVE-2026-64865

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp
• https://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16

euvd · EUVD-2026-60263

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp
• https://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16

nvd · CVE-2026-64865

• https://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16
• https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp

osv · GHSA-j6gc-4893-qwmp

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp
• https://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f
• https://github.com/QuantumNous/new-api
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16

osv · GO-2026-6243

• https://github.com/QuantumNous/new-api/security/advisories/GHSA-j6gc-4893-qwmp
• https://github.com/QuantumNous/new-api/commit/dfc0d6324b40c1d6c2972e524409f933541bfb0f
• https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.16

No related changes are available here.