Read the docs
TI-2026-87005 Aliases CVE-2026-124574

Improper authorization in chenyme grok2api video job retry

Priority LOW 39CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266 and CWE-285.

Summary

chenyme grok2api up to 3.1.6 has improper authorization (CWE-285) in the beginSelectionSession function of its video job retry handler. A remote attacker with low privileges and no user interaction can affect confidentiality, integrity and availability at a low level. The exploit has been publicly disclosed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

Why it matters now

Fix Fixed grok2api (chenyme): 3.1.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
chenymegrok2api3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.63.1.7Patch availableCNA
  • grok2api Vendorchenyme Affected 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.6 Fixed in 3.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*——chenyme
  • cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:* Versions — — ·chenyme

Remediation

Upgrade chenyme grok2api to version 3.1.7, which fixes the issue in patch 199b3ab.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

  • Fix · CNA grok2api (chenyme) Fixed in 3.1.7

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-124574

References

Patch 3

Other 2

  • TI-2026-86141 Improper workflow enforcement in chenyme grok2api STT billing CVSS 4.0MEDIUM 5.3
  • TI-2026-86043 Uncontrolled resource consumption in chenyme grok2api WebSocket proxy CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences