Go · github.com/QuantumNous/new-api
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation
v1.0.0-rc.7 that serialize User.AccessToken as access_token; the issue was confirmed in v0.12.14v1.0.0-rc.70936e2504655a5cbf7bc3c388f6d3e2bb24916d3In affected versions of new-api, the admin user list and user lookup APIs can return the access_token field for users, including the root user. An authenticated admin user can call endpoints such as GET /api/user/ to retrieve user records. Because access tokens function as bearer credentials for API authentication, leaking the root user's access token allows an admin user to authenticate as root and access root-only endpoints such as system configuration APIs.
This bypasses the intended role boundary between admin users and the root user and can result in privilege escalation to full system control.
The User.AccessToken field was serialized as json:"access_token" in affected versions. User management APIs returned User model objects directly after omitting only the password field from database queries, so JSON serialization could include access_token in API responses.
Affected code patterns include user list, user search, and user detail paths that use Omit("password") without preventing access_token from being serialized.
Upgrade to v1.0.0-rc.7 or later. The fix changes User.AccessToken to use json:"-", preventing the field from being serialized in API responses.
Operators should also rotate any root or user access tokens that may have been exposed before upgrading, especially if untrusted admin users had access to user management APIs.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.