What happened
CVE-2026-64859 (CVSS 9.1 Critical) allows a lower-privileged authenticated admin in New API to escalate to full root/system control by extracting the root user's access token from a user-list API response, since the serialization logic fails to exclude the AccessToken field.
Why it matters
New API is a widely deployed self-hosted LLM gateway managing routing, billing, and provider credentials for AI applications; privilege escalation to root grants an attacker full control over the AI platform's configuration, provider keys, and billing.
Attack vector
The admin user-list and user-lookup APIs (e.g. GET /api/user/) serialize the User.AccessToken field for all users, including the root account, because query objects use Omit() incorrectly during serialization; any authenticated admin can retrieve the root user's bearer token and invoke root-only system-configuration APIs, bypassing the intended admin/root privilege boundary.
Affected systems
New API (QuantumNous/new-api), LLM gateway and AI asset-management system, prior to 1.0.0-rc.7
Mitigation
Upgrade to New API >= 1.0.0-rc.7; rotate the root access token; audit administrative API access logs for suspicious root-token usage.