{"apiVersion":"1.0","identifier":"CVE-2026-81027","description":"one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the caller, while the path-parameter branch sets the selected-channel value from c.Param(-channelid-) with no role check at all. The route carrying that parameter sits behind token authentication only, so any account holding a valid API token reaches it. The value flows to the distributor, which loads the channel by integer identifier with no scoping to the caller-s user or group, and then sets the outbound Authorization header to that channel-s stored key and directs the request at the channel-s base URL. A low-privilege account can therefore pin any channel by incrementing an identifier, causing the server to make upstream requests bearing an operator-configured provider key the account was never granted, and bypassing both the per-group restriction and the channel-s model allowlist.","publishedAt":"2026-08-26T16:16:45","lastModifiedAt":"2026-08-26T18:17:05","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-81027","cvssScore":8.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","epssProbability":0.00286,"riskScore":0.87,"affectedProduct":"one-api","affectedVersions":"unknown","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-81027","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-81027","en":"https://www.redsauce.net/en/cves/CVE-2026-81027","fr":"https://www.redsauce.net/fr/cves/CVE-2026-81027","pt":"https://www.redsauce.net/pt/cves/CVE-2026-81027","de":"https://www.redsauce.net/de/cves/CVE-2026-81027","sk":"https://www.redsauce.net/sk/cves/CVE-2026-81027","el":"https://www.redsauce.net/el/cves/CVE-2026-81027"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-81027"}}