CVE-2026-121940: Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Stonewuu ai-fusion-video before 1.3.0 are affected. Any authenticated user may be able to target projects, assets, and scripts belonging to other users.
What does an attacker need to exploit it?
The attacker needs a valid authenticated account and an object ID for a target resource. Because the IDs are auto-incrementing, they may be enumerated through the affected API handlers without user interaction.
What actions can an attacker perform?
An attacker can read or overwrite other users' data, cascade-delete data, and add their own account as a member of another user's project. The affected handlers are /api/project, /api/asset, and /api/script.
How can I determine whether my deployment is affected?
Check whether the deployed ai-fusion-video version is earlier than 1.3.0. Also review access-control behavior on the affected handlers to determine whether authenticated users can retrieve or modify objects by supplying IDs that belong to another user.