Description
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.
Published: 2026-11-04
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Unauthorized data access and modification
Action: Immediate Patch
AI Analysis

Impact

Stonewuu ai‑fusion‑video before version 1.3.0 suffers from an insecure direct object reference flaw (CWE‑639) that permits authenticated users to access, read, overwrite, or delete other users’ projects, assets, and scripts by submitting unscoped object identifiers. The vulnerability enables full read‑write access and even the addition of attackers as project members, potentially exposing sensitive data and compromising the integrity of projects.

Affected Systems

The affected software is Stonewuu ai‑fusion‑video. All releases prior to 1.3.0 are impacted. The flaw manifests in the Project, Asset, and Script controllers that expose /api/project, /api/asset, and /api/script endpoints.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not a known widespread exploit yet. However, the attack vector is likely remote over HTTP APIs, requiring the victim to be an authenticated user. The flaw allows enumeration of auto‑increment IDs, so attackers can systematically target projects and assets irrespective of ownership.

Generated by OpenCVE AI on November 4, 2026 at 13:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Stonewuu ai‑fusion‑video to version 1.3.0 or later to apply the vendor fix.
  • Implement strict authorization checks in the Project, Asset, and Script controllers so that access is granted only to users who own the object or have explicit permissions.
  • Remove the ability to enumerate auto‑increment IDs (e.g., use non‑sequential identifiers or require explicit ID references in requests).

Generated by OpenCVE AI on November 4, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Nov 2026 12:45:00 +0000

Type Values Removed Values Added
Description Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.
Title Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-04T12:31:19.172Z

Reserved: 2026-11-04T12:05:49.883Z

Link: CVE-2026-121940

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-04T13:17:28.393

Modified: 2026-11-04T13:17:28.393

Link: CVE-2026-121940

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-04T14:00:09Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key