Missing Authorization Flaw in Stonewuu ai-fusion-video Affects Non-Admin Users

CVE-2026-110209

What is CVE-2026-110209?

The ai-fusion-video application by Stonewuu is vulnerable due to missing authorization checks, allowing authenticated non-admin users to access sensitive endpoints. These unprotected ApiConfigController and SystemConfigController endpoints can be exploited to read stored secrets, such as AI provider API keys, proxy passwords, and mail passwords. This exposure not only facilitates unauthorized access but also enables potential billing abuse and the capability to send emails impersonating the platform.

References