Read the docs
TI-2026-85051 Aliases CVE-2026-121940GHSA-66jm-x353-x3mc

Stonewuu ai-fusion-video IDOR lets users access other users' projects

Priority HIGH 73CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference flaw, tracked as CWE-639, that lets authenticated users access other users' projects by supplying unscoped object ids. An attacker who is logged in can enumerate auto-increment ids on the /api/project, /api/asset and /api/script handlers to read, overwrite and cascade-delete data, and add themselves as project members. A proof-of-concept exists according to CISA SSVC, but the flaw is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00452 39th percentileScored 2026-11-07
Fix Fixed ai-fusion-video (Stonewuu): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Stonewuuai-fusion-videobefore 1.3.01.3.0Patch availableCNA
  • ai-fusion-video VendorStonewuu Affected before 1.3.0 Fixed in 1.3.0 Patch available CNA

Remediation

Update ai-fusion-video to version 1.3.0 or later, which fixes this flaw. The sources list no fixed version beyond 1.3.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA ai-fusion-video (Stonewuu) Fixed in 1.3.0

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121940
  2. 2026-11-04 Alias added: GHSA-66jm-x353-x3mc
  3. 2026-11-04 CISA SSVC decision points changed
  4. 2026-11-04 Priority changed: MEDIUM → HIGH

References

Patch 1

Advisory 1

Other 2

  • TI-2026-73426 Missing authorization in ai-fusion-video exposes stored credentials CVSS 4.0HIGH 7.1
  • TI-2026-73429 Path traversal in ai-fusion-video lets users write files outside media CVSS 4.0MEDIUM 5.3
  • TI-2026-73430 ai-fusion-video Insecure Direct Object Reference in Task Item Endpoints CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences