CVE-2026-30886 New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
Authenticated users can access other users' video content and trigger upstream AI provider authentication due to missing ownership checks in the video proxy endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30886?
CVE-2026-30886 is a medium-severity missing authorization vulnerability in QuantumNous new-api, published on 23 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (`GET /v1/videos/:task_id/content`) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — `model.GetByOnlyTaskId(taskID)` queries by `task_id` alone with no `user_id` filter, while every other task-lookup in the codebase enforces ownership via `model.GetByTaskId(userId, taskID)`. Version 0.11.4-alpha.2 contains a patch.
Weakness: CWE-639
Which versions are affected by CVE-2026-30886?
3 open source packages ship an affected version, including github.com/QuantumNous/new-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/QuantumNous/new-api Go | All versions | 0.11.4-alpha.2 |
github.com/QuantumNous/new-api Go | All versions | 0.11.4-alpha.2 |
github.com/QuantumNous/new-api Go | All versions | 0.11.4-alpha.2 |
Products include Newapi New Api.
How do I fix CVE-2026-30886?
Upgrade github.com/QuantumNous/new-api to 0.11.4-alpha.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30886 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30886 exists.
Other vulnerabilities in QuantumNous new-api
- CVE-2025-55573 Cross-site scripting in n/a
- CVE-2026-33655 New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLs
- CVE-2026-25802 New API has Potential XSS in its MarkdownRenderer component
- CVE-2026-41432 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud
- CVE-2026-42339 New API: SSRF Filter Bypass via 0.0.0.0
Sources
Also known as GHSA-f35r-v9x5-r8mc, GO-2026-4814.