This vulnerability in QuantumNous new-api (up to version 0.12.1) involves an authorization bypass in the RelayMidjourneyImage/GetByOnlyMJId function within the router/relay-router.go file of the Midjourney Image Relay Endpoint component. An attacker can remotely manipulate this function to bypass authorization checks. The exploit requires no privileges or user interaction but has a high attack complexity. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector, high complexity, and low impact on confidentiality. The vendor has not provided any patch or remediation guidance, and the vulnerability is publicly disclosed.

Successful exploitation could allow an unauthenticated remote attacker to bypass authorization controls in the affected API function, potentially accessing resources or data without proper permissions. The impact on confidentiality is rated low, and there is no indication of integrity or availability impact. The exploitability is difficult, and no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official QuantumNous channels for updates. Until a patch is available, consider implementing additional access controls or network-level restrictions to limit exposure of the vulnerable endpoint.