CVE-2026-9306 - QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

Back Back to CVE browser

MEDIUM

QuantumNous new-api Midjourney Image Relay Endpoint relay-router.go GetByOnlyMJId authorization

Published May 23, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor QuantumNous Product New-Api Default
n/a
- Version
  0.12.0
  Status
  affected
  Constraints
  -
- Version
  0.12.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

QuantumNous

New-Api

n/a

Version	Status	Constraints
0.12.0	affected	-
0.12.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-639

Authorization Bypass

References (4)

https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df
exploit
https://vuldb.com/submit/812196
third-party-advisory
https://vuldb.com/vuln/365253
vdb-entrytechnical-description
https://vuldb.com/vuln/365253/cti
signaturepermissions-required

Link	Providers	Tags
https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df		exploit
https://vuldb.com/submit/812196		third-party-advisory
https://vuldb.com/vuln/365253		vdb-entrytechnical-description
https://vuldb.com/vuln/365253/cti		signaturepermissions-required