PrivacyHigh
CVE-2026-64859: New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management sys…
- Occurred
- Aug 17, 2026
- Published
- Aug 17, 2026
- Source
- NVD CVE
Summary
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.
Tags
- CVE
- CVE-2026-64859
- cvss:CRITICAL
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: Vulnerability allows unauthorized access to root user tokens and system configuration via API serialization flaw.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8