An information disclosure flaw in QuantumNous new-api allows an authenticated administrator to escalate privileges by obtaining the root user's bearer token.

The vulnerability exists in the user lookup and admin user list API endpoints. Due to improper serialization of User model objects, the application inadvertently returns the AccessToken field, granting high-privileged users unauthorized access to sensitive system configuration APIs.

This vulnerability allows for complete compromise of the application's administrative control plane. An attacker with existing administrative access can leverage this information disclosure to gain root-level privileges, potentially leading to full system takeover, unauthorized data access, and the modification of security configurations.

Immediate Action: Upgrade the QuantumNous new-api installation to version 1.0.0-rc.7 or later.

Proactive Monitoring: Audit access logs for unauthorized access to root-only configuration endpoints and monitor for unusual API request patterns from administrative accounts.

Compensating Controls: Restrict access to administrative API endpoints via network-level controls and ensure that API keys are rotated immediately if unauthorized access is suspected.

Public Exploit Available: No

Given the potential for total system compromise, this issue must be addressed with high priority. Organizations should apply the provided patch to prevent unauthorized privilege escalation and ensure the integrity of administrative sessions.