CVE-2026-81027: Missing Authorization in songquanpeng one-api

The vulnerability arises because one-api gates one of its two channel-pinning paths with an admin check but not the other. Specifically, the middleware/auth.go permits channel selection either through an API key suffix or a URL path parameter. The suffix path requires admin validation, but the path-parameter branch does not enforce any role checks and is protected only by token authentication. Consequently, any valid token holder can specify arbitrary channel IDs, causing the server to forward requests with the channel's authorization key. This bypasses per-group restrictions and channel allowlists, allowing unauthorized access to channels and their associated privileges.

An attacker with a valid API token but low privileges can exploit this vulnerability to access or act on behalf of any channel by incrementing the channel identifier. This leads to unauthorized use of operator-configured provider keys and bypasses intended access controls, potentially exposing sensitive data or allowing unauthorized actions within the system. The vulnerability has a CVSS 4.0 base score of 8.4, indicating high severity with network attack vector, low attack complexity, no user interaction, and significant impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API token issuance to trusted users only and monitor for unusual channel access patterns. Avoid using the vulnerable path-parameter channel selection mechanism if possible. Implement additional access controls or request validation to ensure channel identifiers correspond to authorized user groups.