Description

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-17T16:17:22.280Z",
  "pubdate": "2026-08-17T16:17:22.280Z",
  "executiveSummary": "An information disclosure vulnerability exists in the New API large language model (LLM) gateway and artificial intelligence (AI) asset management system prior to version 1.0.0-rc.7. The vulnerability resides within the admin user list and user lookup APIs, specifically affecting endpoints such as GET /api/user/. Due to improper object serialization where the User model objects are serialized subsequent to database queries utilizing Omit(\"password\"), the application inadvertently includes the User.AccessToken attribute as access_token in the API responses.\nThis flaw allows an authenticated administrator to illicitly obtain the root user's bearer token. Consequently, a compromised or malicious administrator can leverage this exposed token to access highly sensitive root-only system configuration APIs, thereby escalating their privileges within the target infrastructure and gaining full administrative control over the AI asset management ecosystem.\nThe risk implications are critical, as unauthorized access to root-only configurations can lead to complete system compromise, data exfiltration, or manipulation of underlying LLM gateway assets. Exploitation of this vulnerability requires prior authentication as an administrative user, enabling the attacker to query the vulnerable user management endpoints and extract the sensitive cryptographic material from the returned JSON payloads.",
  "technicalDetails": "The root cause of this vulnerability stems from insecure data serialization practices within the user management query handling logic of the New API application. Specifically, when administrators query user lists or individual user details via endpoints such as GET /api/user/, the database query utilizes the Omit(\"password\") directive to filter out sensitive password hashes from the resulting dataset.\nHowever, the subsequent object serialization process fails to appropriately exclude sensitive security tokens, specifically the User.AccessToken field. As a result, the serialized JSON response populated to the client explicitly includes the root user's bearer token under the access_token property.\nThe attack flow proceeds as follows: First, an attacker authenticates to the New API platform possessing standard administrative privileges. Second, the attacker issues an HTTP GET request to the vulnerable endpoint GET /api/user/. Third, the application processes the request, queries the database while omitting the password field, but erroneously serializes and returns the User.AccessToken attribute for all queried accounts, including the root user.\nFourth, the attacker parses the HTTP response body to extract the exposed root bearer token. Finally, the attacker uses this stolen bearer token to authenticate subsequent requests made to restricted root-only system configuration APIs, effectively bypassing security boundaries intended to segregate standard administrative duties from root-level infrastructure management.\nThe vulnerable component involves the API routing, database querying, and object serialization logic responsible for handling user resource representations. Affected versions include all deployments of the New API system prior to 1.0.0-rc.7. The vulnerability is exploitable over the network by any authenticated user holding administrative privileges, requiring no specialized payload injection or memory corruption techniques, as the exposure is an inherent artifact of flawed business logic and data serialization."
}