Repeated authenticated PUT /api/user/self requests that modify language or sidebar_modules trigger a race condition in the New API's quota caching logic. The controller calls User.Update and then performs a full RedisHSetObj write to the user’s cache, overwriting concurrent HINCRBY updates that reduce the quota. This allows an authenticated user to keep a cached quota artificially high, enabling resource usage beyond the intended limits.

QuantumNous’s New API before version 1.0.0‑rc.16 is affected. The issue exists in any deployment of the pre‑rc.16 releases that allows repeated PUT requests to /api/user/self.

The CVSS base score of 6 indicates moderate severity. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed large‑scale public exploitation. The exploit requires an authenticated user with privileges to send PUT requests to /api/user/self, which is typically any registered user. Because the flaw is a race condition, the attacker must time concurrent requests to overwrite the cache, which is possible with simple automation. Therefore, the risk is moderate but remains significant for accounts with high resource consumption limits.