New API Flaws Let Attackers Inflate Balance, Reach Root
INCIBE-CERT said New API has two critical flaws in 1.0.0-rc.17 and earlier, and in releases before 1.0.0-rc.7, with a fix shipped as 1.0.0-rc.18 for the affected rc line. The advisory covers CVE-2026-71479 and CVE-2026-64859.
One bug turns user-controlled quantity math into an integer overflow, which can produce a huge negative quota that gets credited back during settlement and inflate a small balance. The other can expose access_token values in admin user listings and search results, letting an admin reuse a bearer token and authenticate as root.
For operators, the exposure is split but connected: one flaw threatens billing integrity, the other turns ordinary admin visibility into full API takeover. If New API sits in front of account or system controls, a single deployment can now carry both fraud risk and root-level privilege risk until the vulnerable releases are replaced.