The vulnerability is an insecure direct object reference that allows an authenticated user to read other users’ generation results by providing arbitrary task identifiers. The attacker can enumerate the sequential task IDs exposed through the /image/items and /video/items endpoints, thereby retrieving images, videos, and accompanying metadata that belong to other users. This results in a breach of confidentiality and violates the principle that a user should only access his or her own data. The weakness is classified as CWE‑639.

Stonewuu’s ai‑fusion‑video application, version 1.2.0, is affected. No other versions or products are listed as susceptible.

With a CVSS score of 5.3, the vulnerability poses a moderate severity risk. The EPSS score is not available, so the current likelihood of exploitation is unknown. The issue is not present in the CISA KEV catalog. Attacks would require an authenticated session; enumeration of task identifiers is trivial, and no additional privileges are needed. The attacker can obtain sensitive content by simply guessing numeric IDs, making the threat practical in a multi‑tenant deployment.