New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.

Affected: Go: github.com/QuantumNous/new-api

## Vulnerability Information

- **Product**: new-api - **Affected versions**: versions before `v1.0.0-rc.7` that serialize `User.AccessToken` as `access_token`; the issue was confirmed in `v0.12.14` - **Patched version**: `v1.0.0-rc.7` - **Fixed commit**: `0936e2504655a5cbf7bc3c388f6d3e2bb24916d3` - **Type**: Information Disclosure / Privilege Escalation

## Description

In affected versions of new-api, the admin user list and user lookup APIs can return the `access_token` field for users, including the root user. An authenticated admin user can call endpoints such as `GET /api/user/` to retrieve user records. Because access tokens function as bearer credentials for API authentication, leaking the root user's access token allows an admin user to authenticate as root and access root-only endpoints such as system configuration APIs.

This bypasses the intended role boundary between admin users and the root user and can result in privilege escalation to full system control.

## Root Cause

The `User.AccessToken` field was serialized as `json:"access_token"` in affected versions. User management APIs returned `User` model objects directly after omitting only the password field from database queries, so JSON serialization could include `access_token` in API responses.

Affected code patterns include user list, user search, and user detail paths that use `Omit("password")` without preventing `access_token` from being serialized.

## Impact

- An authenticated admin user may obtain…