new-api Admin User List Endpoint Leaks Root Access Token, Enables Full Privilege Escalation (CVE-2026-64859)

A GitHub Security Advisory (GHSA-6x2c-phff-wx57) discloses a critical information disclosure and privilege escalation flaw in new-api (github.com/QuantumNous/new-api), tracked as CVE-2026-64859 with a CVSS score of 9.1 and a public PoC. According to the advisory, versions before v1.0.0-rc.7 (confirmed affected in v0.12.14) serialize the User.AccessToken field as access_token in JSON responses. Admin user-management endpoints such as GET /api/user/ reportedly return full User objects after only omitting the password field, so the root user's access token — and potentially other users' tokens — can be exposed to any authenticated admin.

Why It Matters

Because access tokens function as bearer credentials, an admin-level attacker who obtains the root token can impersonate root and reach root-only APIs, per the advisory. That reportedly includes the ability to modify system settings, payment configuration, and OAuth/SMTP settings — effectively a full breakout from the intended admin/root role boundary to complete platform control. Any deployment where the admin role is not fully trusted (multi-tenant instances, shared admin panels, compromised admin accounts) is at elevated risk, and the availability of a public PoC lowers the bar for exploitation.

What Defenders Should Do Now

• Upgrade to v1.0.0-rc.7 or later, which changes User.AccessToken to json:"-" so it is never serialized in API responses.
• Rotate the root user's access token — and other users' tokens — immediately, especially if any admin accounts were not fully trusted prior to patching.
• Review audit/access logs for calls to user list, search, or detail endpoints (e.g. /api/user/) by admin accounts, looking for responses that include an access_token field.
• Hunt for anomalous use of the root account's credentials or access token from source IPs/sessions not associated with the legitimate root operator, and for unexpected changes to system, payment, or OAuth/SMTP configuration.
• As a defense-in-depth measure, review any other model-serialization paths that use field-omission (e.g. Omit("password")) rather than explicit allow-listing, since this pattern is what caused the leak.

This is developing intel based on a same-day GHSA advisory; details may be updated as the vendor and community respond. See the original advisory for full technical details: GHSA-6x2c-phff-wx57.