CVE-2026-110209 in ai-fusion-video
Summary
by MITRE • 10/13/2026
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Stonewuu ai-fusion-video versions through 1.2.0 represents a critical failure in access control mechanisms within the application's backend architecture. Specifically, this is an insecure direct object reference or broken access control issue where authentication checks are either absent or incorrectly implemented for specific administrative endpoints. The affected components include the ApiConfigController and SystemConfigController, which expose sensitive configuration data through unprotected GET and LIST API routes. While these endpoints require a valid session token to be accessed at all, they do not verify whether the authenticated user possesses the necessary administrator privileges to view such high-sensitivity information. This design flaw allows any registered user with a basic account level to bypass intended restrictions and retrieve internal system configurations that should remain strictly confidential.
From a technical perspective, the core of this vulnerability lies in the lack of role-based access control enforcement on specific API endpoints. The application correctly implements authentication, ensuring that only logged-in users can interact with these routes. However, it fails to implement authorization checks that validate the user's role against the required permissions for accessing configuration data. Consequently, an attacker who has successfully authenticated as a standard non-administrative user can send HTTP requests to the api-config and system config endpoints. The server processes these requests without verifying if the requester is authorized to view secrets such as AI provider API keys, proxy passwords, or mail service credentials. This separation of authentication from authorization creates a significant security gap that undermines the integrity of the entire platform's secret management strategy.
The operational impact of this vulnerability is severe and multifaceted. By obtaining access to stored secrets, an attacker gains the ability to abuse third-party services integrated with the platform. For instance, possessing AI provider API keys allows for unauthorized usage of computational resources, leading directly to billing fraud where costs are incurred by the service owner rather than the malicious actor. Furthermore, access to mail passwords enables the attacker to send emails impersonating the platform or its users. This capability can be leveraged for phishing campaigns, spam distribution, or further social engineering attacks against other customers and stakeholders. The exposure of proxy passwords may also facilitate network pivoting or interception of traffic if such proxies are used for internal communications or external API calls, thereby expanding the potential blast radius beyond just financial loss to include data exfiltration and reputation damage.
This vulnerability aligns with CWE-269, Improper Privilege Control, as it involves a user exploiting insufficiently enforced privileges to access restricted resources. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, specifically the sub-technique of using legitimate credentials for unauthorized purposes due to poor authorization logic. Additionally, the exposure of sensitive configuration data relates to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The attack vector is classified as remote with low complexity since it requires only a valid user account and basic API interaction skills, making it highly exploitable by automated tools or script-kiddies alike.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict role-based access control checks within the ApiConfigController and SystemConfigController endpoints. Developers must ensure that any request to retrieve configuration data is validated against a central authorization service that confirms the user holds an administrator role before returning sensitive fields such as API keys or passwords. It is also recommended to apply the principle of least privilege by ensuring that non-admin users are not even able to invoke these endpoints, rather than just blocking them from viewing secrets after authentication. Furthermore, existing exposed credentials should be considered compromised and rotated immediately across all affected systems. Long-term improvements include integrating automated security testing into the CI/CD pipeline to detect missing authorization checks early in development and conducting regular penetration tests focused on access control logic to prevent similar flaws from being introduced in future releases.