—
GO-2026-6243
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
Quick fix
GO-2026-6243 — github.com/QuantumNous/new-api: upgrade to the fixed version with the command below.
go get github.com/QuantumNous/new-api@v1.0.0-rc.16Details
New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass in github.com/QuantumNous/new-api
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/QuantumNous/new-api
Introduced in:
0Fixed in: 1.0.0-rc.16Fix
go get github.com/QuantumNous/new-api@v1.0.0-rc.16