CVE-2026-9306 Details
Description
A security vulnerability has been detected in QuantumNous new-api up to 0.12.1. This affects the function RelayMidjourneyImage/GetByOnlyMJId of the file router/relay-router.go of the component Midjourney Image Relay Endpoint. Such manipulation leads to authorization bypass. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
An authorization bypass vulnerability has been identified in QuantumNous new-api versions through 0.12.1. The issue arises in the Midjourney Image Relay Endpoint, specifically within the RelayMidjourneyImage function of the router/relay-router.go file. The vulnerability allows unauthenticated users to access and retrieve images belonging to other users by exploiting the endpoint '/mj/image/:id'. This is possible because the endpoint lacks proper authentication and object-level authorization, enabling cross-user image disclosure.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 23, 2026CISA-ADP
Assessed May 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df | [email protected] | ExploitTechnical Description |
| https://vuldb.com/submit/812196 | [email protected] | Permission Required |
| https://vuldb.com/vuln/365253 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/365253/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| QuantumNous new-api | 0.12.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 23, 2026 | New CVE Received | [email protected] |