QuantumNous new-api CVE-2026-9305

Exploitation requires authenticated access with low-level user privileges (PR:L) to the QuantumNous new-api application. Attackers must have valid credentials to reach the self endpoint where SearchUserTopUps and SearchAllTopUps functions are exposed. The vulnerable functions must be accessible through the application's routing configuration, specifically the topup search feature in the self endpoint. No special configuration beyond default deployment is required - standard installations with authentication enabled are vulnerable. The absence of input validation or parameterized queries in model/topup.go enables exploitation. Attack limitations include: authentication requirement prevents anonymous exploitation, unchanged scope (S:U) restricts impact to the application's security context rather than underlying system, and low CIA impact (C:L/I:L/A:L) suggests database permissions or query context may limit the extent of data access or modification compared to full database compromise.

Real-world risk is moderate with elevated concern due to public exploit availability. CVSS 6.3 reflects medium severity with network attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L), indicating authenticated users can remotely exploit this without technical barriers. The CVSS temporal metrics show proof-of-concept exploit exists (E:P) with reported reliability (RC:R) and no official remediation timeline (RL:X). Most critically, a functional exploit has been published on GitHub (https://gist.github.com/YLChen-007/cf501d0a66c81298b2f97e854f3813db), significantly lowering the skill threshold for exploitation. However, exploitation requires authenticated access (PR:L), which provides some defensive friction compared to unauthenticated vulnerabilities. The vendor's non-response to disclosure attempts raises concern about patch availability and ongoing support. Impact is limited to low confidentiality, integrity, and availability (C:L/I:L/A:L) within unchanged scope (S:U), suggesting attackers can extract or modify data within the application's permission boundaries rather than achieving full system compromise. Organizations running new-api versions ≤0.12.1 with exposed self endpoints should prioritize remediation, especially if the application handles sensitive financial or user data in the topup system.

An authenticated attacker with low-level credentials logs into the QuantumNous new-api application and navigates to the self endpoint's topup search functionality. They craft a malicious HTTP request to SearchUserTopUps or SearchAllTopUps, injecting SQL syntax such as ' OR 1=1-- or UNION SELECT statements into search parameters. The vulnerable model/topup.go code concatenates this input directly into SQL queries without sanitization, causing the database to execute the attacker's commands alongside legitimate query logic. The attacker extracts sensitive user data, topup transaction records, or authentication tokens from database tables, modifies financial balances, or causes service degradation through resource-intensive queries.