CVE-2026-110209: ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mailpassword, enabling billing abuse and sending mail as the platform.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who is not an administrator can exploit the affected configuration read endpoints. No user interaction is required.
What data can an attacker obtain?
An attacker can retrieve stored AI provider API keys, proxy passwords, and the mail_password value through the API configuration get/list and system configuration endpoints.
What can stolen credentials be used for?
Exposed AI provider API keys can enable billing abuse. The exposed mail password can allow an attacker to send mail as the platform.
Which versions are affected?
Stonewuu ai-fusion-video through version 1.2.0 is affected.