Skip to content
Threat Feed
Subscribe
high advisory

Stonewuu ai-fusion-video Insecure Direct Object Reference (CVE-2026-121940)

Stonewuu ai-fusion-video versions before 1.3.0 are vulnerable to an IDOR vulnerability in multiple API endpoints, allowing authenticated attackers to perform unauthorized read, modification, and deletion of data via ID enumeration.

CVE search metadata

CVE search record: CVE-2026-121940. Severity: high. CVSS: 8.8. KEV: no. Product: ai-fusion-video (< 1.3.0). Brief: Stonewuu ai-fusion-video Insecure Direct Object Reference (CVE-2026-121940). Brief link: https://feed.craftedsignal.io/briefs/2026-11-stonewuu-idor/

Triage facts

Revision 1
Applicability
ai-fusion-video (< 1.3.0)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 4, 14:47 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Stonewuu ai-fusion-video before version 1.3.0 contains an insecure direct object reference (IDOR) vulnerability. Authenticated users can access, modify, or delete sensitive project data by manipulating auto-incrementing object IDs in API requests. Successful exploitation enables unauthorized data access, unauthorized data modification/deletion, and unauthorized project membership escalation.

Impact

Attackers can read, overwrite, and cascade-delete project assets and scripts, as well as add themselves as project members, leading to full compromise of project data integrity and confidentiality.

Recommendation

  • Upgrade Stonewuu ai-fusion-video to version 1.3.0 or later immediately.
  • Review access logs for the affected API paths for abnormal patterns indicative of ID enumeration (e.g., sequential ID requests from a single user session).
  • Implement rate limiting on API endpoints to mitigate automated enumeration attempts.

Immediate actions

Upgrade ai-fusion-video to version 1.3.0 or later

IT Operations 48h

Threat Hunt

Identify accounts frequently requesting multiple project objects in short windows

T1595.002 high medium confidence hunt now

Data: Web server logs containing URI stem and source IP

Mitigations

Upgrade ai-fusion-video to 1.3.0

immediate IT Operations

CVE-2026-121940

Detection coverage 1

Detect Potential IDOR Enumeration - /api/project, /api/asset, /api/script

high

Detects potential IDOR enumeration by tracking high volumes of sequential or rapid requests to project-related API handlers by a single authenticated session.

sigma tactics: privilege-escalation techniques: T1595.002 sources: webserver

Detection queries are available on the platform. Get full rules →