CVE-2026-110213

Awaiting Analysis Awaiting Analysis - Queue

Insecure Direct Object Reference in Stonewuu AI-Fusion-Video

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110213

EUVD

EUVD-2026-99254

Affected Vendors & Products

Vendor	Product	Version / Range
Stonewuu	ai-fusion-video	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Stonewuu ai-fusion-video through version 1.2.0. It allows authenticated users to access other users' generation results by manipulating task IDs. Attackers can enumerate auto-incremented task IDs on image and video endpoints to retrieve sensitive data like generated images, videos, and output metadata.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to image and video generation endpoints. Check for repeated requests to /items endpoints with varying task IDs. Inspect logs for unusual data retrieval patterns from authenticated users.

Impact Analysis

If you use Stonewuu ai-fusion-video, an attacker with access could view your generated images, videos, or metadata from other users. This could lead to privacy breaches, data leaks, or unauthorized access to sensitive content depending on the application's use case.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking protected health information if the application handles such data. It undermines data protection requirements for confidentiality and access controls.

Mitigation Strategies

Immediately update ai-fusion-video to the latest version beyond 1.2.0. Implement strict authorization checks to ensure users can only access their own data. Disable or restrict access to the /items endpoints until patched.

Hi! I’m here to help you understand CVE-2026-110213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70