CVE-2026-64859

Name of the Vulnerable Software and Affected Versions new-api versions prior to 1.0.0-rc.7

Description An information disclosure issue exists in the admin user list and user lookup APIs, specifically the 'GET /api/user/' endpoint. The system serializes User.AccessToken as access token because user model objects are returned after queries only omit the password field. This allows an authenticated administrator to obtain the root user's bearer token, which functions as a credential for API authentication. Consequently, an attacker can impersonate the root user to access root-only system configuration APIs, modify payment settings, and change OAuth or SMTP configurations, leading to full system control.

Recommendations Update to version 1.0.0-rc.7 or later. Rotate all root and user access tokens that may have been exposed prior to the update.