CVE-2026-81027

Name of the Vulnerable Software and Affected Versions one-api (affected versions not specified)

Description An issue exists in middleware/auth.go where one of two channel-pinning paths is not properly gated. While requests using a suffix on the API key require model.IsAdmin to succeed, requests using the URL path parameter channelid do not undergo a role check. Any account with a valid API token can access this path. The channelid value is passed to the distributor, which loads the channel by integer identifier without scoping it to the caller's user or group. This allows a low-privilege account to pin any channel by incrementing the identifier, forcing the server to make upstream requests using an operator-configured provider key and bypassing per-group restrictions and the channel's model allowlist.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.