CVE-2026-64866
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In New API (LLM gateway and AI asset management system) from 0.9.1.3 to 1.0.0-rc.7, the AdminResetPasskey function in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account.
Risk Assessment
A lower-privileged administrator could take over higher-privileged accounts, potentially leading to unauthorized system access.
Recommendation
Update New API to version 1.0.0-rc.7 or later to fix the vulnerability.
Original NVD description (English source)
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account. This issue is fixed in version 1.0.0-rc.7.