PT-2026-42886 · Quantumnous · New Api

Eric-E · CVE-2026-9306 · Published 2026-05-23 · Updated 2026-05-23

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 0.12.2

Description An issue in the Midjourney Image Relay Endpoint component, specifically within the RelayMidjourneyImage/GetByOnlyMJId() function located in the router/relay-router.go file, allows for a remote authorization bypass. This bypass occurs through manipulation of the function, although the attack is characterized by high complexity and difficult exploitability.

Recommendations Update to a version later than 0.12.1. As a temporary workaround, restrict access to the RelayMidjourneyImage/GetByOnlyMJId() function to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-9306

Affected Products

New Api

References · 6

• 🔥 https://gist.github.com/YLChen-007/13974ead25fc6dac42fd7bac62fbb2df · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9306 · Security Note
• https://vuldb.com/vuln/365253/cti · Note
• https://vuldb.com/vuln/365253 · Note
• https://t.me/CVEtracker/54716 · Telegram Post
• https://vuldb.com/submit/812196 · Note