CVE-2026-124574: chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization

Q: What access does an attacker need to exploit this issue?

The attack can be initiated remotely, but the vulnerability has a low-privileges-required rating. An attacker therefore needs an account or other low-level authenticated access before targeting the Video Job Retry Handler.

Q: Which deployments are affected and what version fixes the issue?

chenyme grok2api versions up to and including 3.1.6 are affected. Upgrade to version 3.1.7, which includes patch 199b3abecc14907176dae1f1cacf125419caa94d.

Q: How urgent is remediation?

The issue is rated medium severity with a 6.3 CVSS score, and public exploit information is available. Prioritize updates for remotely reachable deployments where low-privileged users can access video job retry functionality.

Published Nov 9, 2026

Updated

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

Affected Software

1 affected component

chenyme grok2api<=3.1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade chenyme grok2api to a version that resolves this vulnerability.
Fixed in 3.1.7Patch 199b3abecc14907176dae1f1cacf125419caa94d

Event History

Nov 9, 2026

CVE Published

via MITRE·06:30 AM

Data Sourced

via MITRE·06:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be initiated remotely, but the vulnerability has a low-privileges-required rating. An attacker therefore needs an account or other low-level authenticated access before targeting the Video Job Retry Handler.

Which deployments are affected and what version fixes the issue?

chenyme grok2api versions up to and including 3.1.6 are affected. Upgrade to version 3.1.7, which includes patch 199b3abecc14907176dae1f1cacf125419caa94d.

How urgent is remediation?

The issue is rated medium severity with a 6.3 CVSS score, and public exploit information is available. Prioritize updates for remotely reachable deployments where low-privileged users can access video job retry functionality.

CVE-2026-124574: chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected and what version fixes the issue?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which deployments are affected and what version fixes the issue?

How urgent is remediation?