CVE-2026-110213 — ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supp…
Published: 2026-10-13 · CVSS: 5.3 · CVSS 4.0
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the image and video /items endpoints to obtain other users' generated images, videos, and output metadata.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7