{"action":"Upgrade github.com/QuantumNous/new-api to 0.11.4-alpha.2 or later.","affected":[{"fixed":"0.11.4-alpha.2","introduced":"0"}],"component":"github.com/QuantumNous/new-api","cve_ids":["CVE-2026-30886"],"ecosystem":"Go","epss":0.00279,"exploited":false,"fixed_versions":["0.11.4-alpha.2"],"ghsa_id":"GHSA-f35r-v9x5-r8mc","id":"tcs_01M5KGG9019H8H1DF89Y65SGC8","modified_at":"2026-03-26T21:03:43.627826Z","published_at":"2026-03-26T20:33:02Z","references":["https://osv.dev/vulnerability/GO-2026-4814","https://github.com/QuantumNous/new-api/security/advisories/GHSA-f35r-v9x5-r8mc","https://nvd.nist.gov/vuln/detail/CVE-2026-30886","https://github.com/QuantumNous/new-api/commit/50ec2bac6b341e651fc9ac4344e3bd2cdaeafdbd"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-4814","url":"https://osv.dev/vulnerability/GO-2026-4814"}],"summary":"New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check in github.com/QuantumNous/new-api"}