Authorization Bypass in one-api Affects Valid API Token Holders

CVE-2026-81027

What is CVE-2026-81027?

The one-api product has a significant vulnerability due to insufficient authorization checks in its channel pinning functionality. Specifically, the middleware code allows a low-privilege user to specify a channel via a URL path parameter without adequate role verification. This can enable unauthorized access to specific channels by merely incrementing the channel identifier, which leads to the server executing requests with an operator-configured provider key. This vulnerability undermines the intended access controls and may expose sensitive data or functionalities. Users holding valid API tokens can exploit this oversight, thus making it critical for administrators to review their deployment versions and apply necessary mitigations.

References