CVE-2026-110213

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Stonewuuai-fusion-video<= 1.2.0

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1102143.7Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/filCVE-2026-1102158.8youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and buttoCVE-2026-1102167.1youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts bCVE-2026-1102176.5Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operaCVE-2026-1102183.7Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blogCVE-2026-1102195.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the priCVE-2026-110226.5Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromisedCVE-2026-1102207.1Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controlCVE-2026-1102215.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featurCVE-2026-1102225.3Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests byCVE-2026-1102233.1Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blockliCVE-2026-1102245.4QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes reject