New API Admin API Exposes Root User Access Token

New API, a large language model (LLM) gateway and AI asset management system, has an access token disclosure vulnerability.

Prior to version 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password").

• Affected versions: before 1.0.0-rc.7
• Precondition: an authenticated administrator
• Impact: obtain the root user's bearer token and access root-only system configuration APIs

The issue is fixed in version 1.0.0-rc.7.