CVE-2026-110213 in ai-fusion-video
Summary
by MITRE • 10/13/2026
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in Stonewuu ai-fusion-video versions through 1.2.0 represents a critical failure in access control mechanisms, specifically classified as an Insecure Direct Object Reference or IDOR under the CWE-639 standard. This flaw arises from the application's reliance on predictable and sequential identifiers for internal resources without implementing adequate authorization checks to verify that the requesting user has permission to access those specific objects. By accepting arbitrary task IDs in API requests, particularly within the image and video /items endpoints, the system fails to bind these resource references to the authenticated session of the current user. This architectural oversight allows any authenticated actor to bypass intended privacy boundaries simply by manipulating the input parameters sent to the server.
From an operational perspective, this vulnerability enables a straightforward enumeration attack where malicious users can iterate through sequential task identifiers to discover and retrieve data belonging to other individuals. Since the application generates auto-incrementing IDs for tasks such as image or video generation, attackers do not need complex exploitation techniques to locate valid targets; they merely need to send requests with incrementally changing ID values until a response containing sensitive content is received. The impact of this breach extends beyond simple data leakage, as it compromises the confidentiality and integrity of user-generated media assets along with associated metadata. This exposure can lead to significant privacy violations, intellectual property theft, or reputational damage for affected users whose private creations are exposed without consent.
The exploitation path aligns closely with techniques documented in the MITRE ATT&CK framework, specifically under T1078 Valid Accounts and potentially T1592 Gather Victim Host Information if used to map out user activity patterns through metadata analysis. The attacker leverages valid authentication credentials to gain initial access but then abuses their privileges by accessing resources associated with other accounts due to the lack of proper object-level authorization checks. This scenario highlights a common pitfall in modern web applications where developers assume that because a user is authenticated, they should have unrestricted access to all data accessible via the API endpoints they can reach, ignoring the necessity for explicit ownership verification on each resource request.
To mitigate this vulnerability, immediate remediation efforts must focus on implementing robust authorization checks at the application logic layer rather than relying solely on network-level security or authentication tokens. Developers should ensure that every API endpoint handling sensitive resources verifies that the authenticated user is the legitimate owner of the requested task ID before returning any data. This can be achieved by maintaining a secure mapping between users and their generated tasks in the database, ensuring that queries always include conditions restricting access to records belonging exclusively to the requesting identity. Additionally, replacing auto-incrementing integer IDs with cryptographically random identifiers such as UUIDs can significantly reduce the feasibility of enumeration attacks, although this measure alone is insufficient without proper authorization logic. Regular security testing and code reviews focusing on object-level permissions are essential to prevent similar flaws in future iterations of the software.