Skip to content
CVE PROGRAM SOURCE RECORD6.0 Medium

CVE-2026-64865

New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

QuantumNous new-api

  • < 1.0.0-rc.16affected

References