CVE-2026-30886: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check

March 23, 2026 (updated March 25, 2026)

The video proxy endpoint GET /v1/videos/:task_id/content is vulnerable to an Insecure Direct Object Reference (IDOR). Any authenticated user who knows another user’s task_id can retrieve that user’s generated video content because the handler queries tasks by task_id alone and does not verify ownership.

References

github.com/QuantumNous/new-api
github.com/QuantumNous/new-api/commit/50ec2bac6b341e651fc9ac4344e3bd2cdaeafdbd
github.com/QuantumNous/new-api/security/advisories/GHSA-f35r-v9x5-r8mc
github.com/advisories/GHSA-f35r-v9x5-r8mc
nvd.nist.gov/vuln/detail/CVE-2026-30886

Code Behaviors & Features

Detect and mitigate CVE-2026-30886 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →