PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9306 QuantumNous CVE debrief

A low-severity authorization bypass vulnerability affects QuantumNous new-api versions up to 0.12.1. The flaw resides in the RelayMidjourneyImage/GetByOnlyMJId function within router/relay-router.go, specifically at the Midjourney Image Relay Endpoint. Successful exploitation allows remote attackers to bypass authorization controls, though the attack requires high complexity and is considered difficult to exploit. The vulnerability was disclosed publicly on 2026-05-23 after the vendor was contacted but did not respond. The CVSS 4.0 score of 2.9 reflects the network attack vector, high attack complexity, and low confidentiality impact with no integrity or availability impact. The weakness is associated with CWE-285 (Improper Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key).

Vendor
QuantumNous
Product
new-api
CVSS
LOW 2.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-23
Original CVE updated
2026-07-23
Advisory published
2026-05-23
Advisory updated
2026-07-23

Who should care

Organizations running QuantumNous new-api versions ≤0.12.1 with exposed Midjourney integration endpoints; security teams monitoring for authorization bypass patterns in AI/ML API gateways.

Technical summary

The vulnerability exists in the Go-based new-api application's relay router component. The GetByOnlyMJId function fails to properly validate authorization before processing Midjourney image relay requests. The attack surface is network-accessible but requires complex manipulation to exploit. No integrity or availability impact is associated with successful exploitation.

Defensive priority

LOW

Recommended defensive actions

  • Review and restrict access to the Midjourney Image Relay Endpoint in new-api deployments
  • Apply authorization checks in the RelayMidjourneyImage/GetByOnlyMJId function path
  • Monitor for unauthorized access attempts to /router/relay-router.go endpoints
  • Upgrade to new-api version beyond 0.12.1 when a patched release becomes available
  • Review application logs for anomalous Midjourney relay requests prior to 2026-05-23

Evidence notes

Vulnerability data sourced from NVD with Vuldb as CNA. CVSS 4.0 vector: AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. NVD status is 'Deferred' as of 2026-05-26. Vendor identification is low-confidence based on reference domain analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9306 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9306

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9306 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9306

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.