An attacker with a valid, low-privilege API token can manipulate the "channelid" parameter in the URL. The application then uses this identifier to load the corresponding channel's credentials without verifying if the caller is authorized to access that specific channel or group. Consequently, the server proxies requests to the upstream provider using the operator's configured keys, effectively bypassing security controls including per-group restrictions and model allowlists. This allows unauthorized access to service provider endpoints and potentially incurs costs or exposes sensitive configuration data.

Impact

Successful exploitation allows low-privileged users to bypass access controls and interact with unauthorized upstream LLM providers or services using the organization's API keys. This can lead to unauthorized resource consumption, potential data exfiltration via third-party providers, and the circumvention of established cost-management and policy-based controls. The vulnerability affects the core authorization flow of the one-api platform.

Recommendation

• Upgrade one-api to the version containing the fix for CVE-2026-81027 immediately.
• Review application logs for anomalous patterns in requests containing channel identifiers in the URI path.
• Monitor for requests where the user context does not align with the requested channel ID or administrative roles.