GHSA-P845-629J-RCJ6

Vulnerability from github – Published: 2026-08-17 16:36 – Updated: 2026-08-17 16:36
VLAI
Summary
New API: Admin can reset passkeys for same-level or higher-privileged users
Details

Summary

The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts.

Impact

If the target account had a passkey configured, a lower-privileged administrator could remove that authentication factor and weaken the target account's protection boundary. The attacker still needed administrator privileges, so the issue is rated Medium.

Affected versions

The vulnerable admin passkey reset behavior was present from the passkey feature introduction in v0.9.1.3 through versions before v1.0.0-rc.7.

Patches

This issue is fixed in v1.0.0-rc.7. The fix adds a canManageTargetRole check to AdminResetPasskey before passkey lookup or deletion, preventing lower-privileged administrators from operating on same-level or higher-privileged users.

Workarounds

If upgrading immediately is not possible, restrict admin access to trusted operators only and block DELETE /api/user/:id/reset_passkey at the reverse proxy or gateway except for root operators.

References

  • Fixed by commit 0936e2504655a5cbf7bc3c388f6d3e2bb24916d3.
  • Relevant code paths: controller/passkey.go, controller/twofa.go, and router/api-router.go.
Severity
5.1 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/QuantumNous/new-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.1.3"
            },
            {
              "fixed": "1.0.0-rc.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-64866"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T16:36:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts.\n\n## Impact\n\nIf the target account had a passkey configured, a lower-privileged administrator could remove that authentication factor and weaken the target account\u0027s protection boundary. The attacker still needed administrator privileges, so the issue is rated Medium.\n\n## Affected versions\n\nThe vulnerable admin passkey reset behavior was present from the passkey feature introduction in `v0.9.1.3` through versions before `v1.0.0-rc.7`.\n\n## Patches\n\nThis issue is fixed in `v1.0.0-rc.7`. The fix adds a `canManageTargetRole` check to `AdminResetPasskey` before passkey lookup or deletion, preventing lower-privileged administrators from operating on same-level or higher-privileged users.\n\n## Workarounds\n\nIf upgrading immediately is not possible, restrict admin access to trusted operators only and block `DELETE /api/user/:id/reset_passkey` at the reverse proxy or gateway except for root operators.\n\n## References\n\n- Fixed by commit `0936e2504655a5cbf7bc3c388f6d3e2bb24916d3`.\n- Relevant code paths: `controller/passkey.go`, `controller/twofa.go`, and `router/api-router.go`.",
  "id": "GHSA-p845-629j-rcj6",
  "modified": "2026-08-17T16:36:05Z",
  "published": "2026-08-17T16:36:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-p845-629j-rcj6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/pull/4929"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/commit/0936e2504655a5cbf7bc3c388f6d3e2bb24916d3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/QuantumNous/new-api"
    },
    {
      "type": "WEB",
      "url": "https://github.com/QuantumNous/new-api/releases/tag/v1.0.0-rc.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "New API: Admin can reset passkeys for same-level or higher-privileged users"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.