CVE-2026-121940— Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

Quick assessment

Affected

Stonewuu ai-fusion-video

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Stonewuu ai-fusion-video 1.3.0 之前的版本存在不安全的直接对象引用（IDOR）漏洞。该漏洞允许已认证用户通过提供未作用域的对象 ID，访问其他用户的项目。攻击者可在、和接口上枚举自增 ID，从而读取、覆盖、级联删除数据，并将自己添加为项目成员。

CVSS 8.8 · High Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1086

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

Source: CVE Program / CVE List V5

Vulnerability Description

Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Stonewuu	ai-fusion-video	0 ~ 1.3.0	-

II. Public POCs for CVE-2026-121940

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121940

请登录查看更多情报信息。

Other References for CVE-2026-121940 (5)

https://github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/project/ProjectController.java#L37-L113 technical-description
https://hackmd.io/@hieuPenguinnn/ai-fusion-video-idor-bola-project-asset third-party-advisory
https://github.com/Stonewuu/ai-fusion-video/issues/69 issue-tracking
https://github.com/Stonewuu/ai-fusion-video/commit/4724a1a4173171c3d4d067f38840a6093a8c4d46 patch
https://www.vulncheck.com/advisories/stonewuu-ai-fusion-video-before-1.3.0-idor-via-project-asset-and-script-controllers third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121940

IV. Related Vulnerabilities

Same product: ai-fusion-video

Same vendor: Stonewuu

Same weakness: CWE-639