CVE-2026-30886
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system.
Published Mar 23, 2026 · updated Jun 17, 2026 · newapi new api
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint ( ) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — queries by alone with no filter, while every other task-lookup in the codebase enforces ownership via . Version 0.11.4-alpha.2 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint ( ) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using c
Jun 17, 2026 · NIST NVD
Updated
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint ( ) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using c
Affected
- cpe newapi/new apiversion unspecified
- cpe newapi/new api0.11.4
Sources
- CVE.orgVulnerability recordCVE-2026-30886
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-30886
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint ( ) allows any authentica
nvd.nist.gov