CyberRota Analysis
AI-GeneratedThe vulnerability affects the New API, an AI asset management system, where an authenticated user can exploit a race condition in the PUT /api/user/self endpoint to manipulate their cached quota. This allows users to maintain an artificially inflated quota by overwriting concurrent deductions, potentially leading to unauthorized resource consumption. Organizations utilizing versions prior to 1.0.0-rc.16 should prioritize updating to the fixed version to mitigate the risk of quota abuse.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16.