Vulnerabilities CVE-2026-64865

CVE-2026-64865

Medium

Open

TLP:CLEAR

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.

Details

CVSS Score: 6.0
EPSS Score ⓘ: 0.24%

15.8th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 17, 2026
Last Modified: Aug 18, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.