The flaw exists because the ApiConfigController and SystemConfigController expose their configuration endpoints without performing authorization checks. Authorized users who are not administrators can therefore retrieve sensitive credentials, including AI provider API keys, proxy passwords, and mail passwords. The result is a confidentiality breach that can lead to billing abuse or malicious mail sending on behalf of the platform.

Stonewuu ai‑fusion‑video version 1.2.0 is affected. The issue resides in the configuration‑reading endpoints shipped with that release.

This vulnerability scores 7.1 on CVSS, indicating a high severity risk. EPSS is not reported, and the flaw is not listed in the CISA KEV catalog. Because the flaw requires an authenticated session, an attacker must possess valid user credentials—typically a regular user account—before capitalizing on the vulnerability. Once authenticated, the attacker can query the unprotected endpoints to obtain the stored credentials, which can then be abused for billing, data exfiltration, or spamming.