Insecure Direct Object Reference in Stonewuu ai-fusion-video Product
CVE-2026-110213

5.3MEDIUM

Key Information:

Vendor

Stonewuu

Status
Ai-fusion-video
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110213?

The Stonewuu ai-fusion-video application, up to version 1.2.0, has an insecure direct object reference vulnerability that allows authenticated users to access and read other users' generation results. By submitting arbitrary task IDs, attackers can exploit endpoints related to image and video generation to enumerate and retrieve files from other users, including images, videos, and associated metadata, leading to unauthorized data exposure.

Affected Version(s)

ai-fusion-video 0 <= 1.2.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ai-fusion-video...
third-party-advisory
https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/a...
technical-description
https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/a...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.