This vulnerability affects the QuantumNous new-api product, versions 0.12.0 and 0.12.1, in the router/relay-router.go file's RelayMidjourneyImage/GetByOnlyMJId function. It allows an attacker to bypass authorization mechanisms remotely, potentially accessing resources without proper permissions. The attack complexity is high, and no privileges or user interaction are required. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, high complexity, and low impact on confidentiality. The vendor has not issued any patch or advisory, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated remote attacker to bypass authorization controls in the affected API endpoint, potentially gaining unauthorized access to Midjourney image relay resources. The impact on confidentiality is low, and there is no reported impact on integrity or availability. Due to the high complexity and lack of known exploits, the immediate risk is moderate but should be monitored.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing additional access controls or network-level restrictions around the affected API endpoint to mitigate risk. Monitor for any future vendor advisories or patches and apply them promptly once available.