CVE-2026-110213: ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who can call the image or video generation item endpoints can attempt to read other users’ generation results. No user interaction is required.
What information can be exposed?
An attacker can obtain other users’ generated images, videos, and associated output metadata.
What does an attacker need to do?
The attacker supplies arbitrary task IDs to the image and video /items endpoints. Because task IDs are auto-incrementing, they can be enumerated to retrieve other users’ records.
How can I tell whether my deployment is affected?
Deployments of Stonewuu ai-fusion-video through version 1.2.0 are affected. Test with two authenticated accounts by requesting one account’s generation task ID through the other account’s image or video /items endpoint and checking whether the result is returned.