CVE-2026-110213
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids.
Does this matter?
Lower severity and a low EPSS score (0.34%). Track it; it rarely justifies an emergency change on its own.
Description
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.34% probability · 28th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Source
- disclosure@vulncheck.com
EPSS moved from 0.3% on 14 October 2026 to 0.3% on 26 October 2026.
References
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/generation/ImageGenerationController.java#L50-L54
- https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/generation/VideoGenerationController.java#L49-L53
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ai-fusion-video-broken-access-control-and-upload-path-traversal
- https://www.vulncheck.com/advisories/ai-fusion-video-through-1.2.0-insecure-direct-object-reference-in-generation-task-item-endpoints
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.