CVE-2026-30886: New API: IDOR in VideoProxy allows cross-user video content access via missing ownership check
Summary
The video proxy endpoint GET /v1/videos/:taskid/content is vulnerable to an Insecure Direct Object Reference (IDOR). Any authenticated user who knows another user's taskid can retrieve that user's generated video content because the handler queries tasks by taskid alone and does not verify ownership.
Affected Component
- Endpoint: GET /v1/videos/:taskid/content - Route middleware: TokenOrUserAuth() - Vulnerable handler: controller.VideoProxy
Details
VideoProxy fetches the task with:
go task, exists, err := model.GetByOnlyTaskId(taskID)
GetByOnlyTaskId performs a database lookup using only taskid:
go err = DB.Where("taskid = ?", taskId).First(&task).Error
The authenticated user's ID is available in request context, but VideoProxy does not use it. This allows any authenticated user to request /v1/videos/<foreigntaskid>/content and access another user's video if they know a valid task ID.
Other task-fetch paths already enforce ownership correctly via:
go model.GetByTaskId(userId, taskId)
Impact
An authenticated attacker who knows another user's taskid can:
- Download video content belonging to another user - Bypass tenant isolation for generated media assets - Cause the server to fetch upstream video content for a task the attacker does not own
For Gemini tasks, the proxy also uses task.PrivateData.Key when contacting the upstream provider. In addition, full upstream response headers are forwarded back to the requester.
Proof of Concept
bash curl -o stolenvideo.mp4 \ "https://<instance>/v1/videos/<victimtaskid>/content" \ -H "Authorization: Bearer sk-<attackertoken>"
Expected result:
- Response returns 200 OK - Response body contains the victim's video content
Recommended Fix
Replace the task lookup in VideoProxy with an ownership-checked query:
go userId := c.GetInt("id") task, exists, err := model.GetByTaskId(userId, taskID)
Other sources
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Object Reference (IDOR) vulnerability in the video proxy endpoint (GET /v1/videos/:taskid/content) allows any authenticated user to access video content belonging to other users and causes the server to authenticate to upstream AI providers (Google Gemini, OpenAI) using credentials derived from tasks they do not own. The missing authorization check is a single function call — model.GetByOnlyTaskId(taskID) queries by taskid alone with no userid filter, while every other task-lookup in the codebase enforces ownership via model.GetByTaskId(userId, taskID). Version 0.11.4-alpha.2 contains a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30886?
CVE-2026-30886 is classified as a moderate severity vulnerability due to the potential for unauthorized access to video content.
How do I fix CVE-2026-30886?
To fix CVE-2026-30886, upgrade the New API to version 0.11.4-alpha.2 or later, which implements the necessary ownership checks.
What kind of attack does CVE-2026-30886 enable?
CVE-2026-30886 enables an Insecure Direct Object Reference (IDOR) attack that allows an authenticated user to access another user's content if they know the task_id.
Which software versions are affected by CVE-2026-30886?
CVE-2026-30886 affects all versions of the New API prior to 0.11.4-alpha.2.
Who is impacted by CVE-2026-30886?
Any authenticated user of the New API is potentially impacted by CVE-2026-30886 if they can guess another user's task_id.