Cpe:2.3:a:stonewuu:ai-Fusion-Video:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3astonewuuai-fusion-video/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 14:47:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStonewuu ai-fusion-video Insecure Direct Object Reference (CVE-2026-121940)https://feed.craftedsignal.io/briefs/2026-11-stonewuu-idor/Wed, 04 Nov 2026 14:47:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-stonewuu-idor/Stonewuu ai-fusion-video versions before 1.3.0 are vulnerable to an IDOR vulnerability in multiple API endpoints, allowing authenticated attackers to perform unauthorized read, modification, and deletion of data via ID enumeration.Stonewuu ai-fusion-video before version 1.3.0 contains an insecure direct object reference (IDOR) vulnerability. Authenticated users can access, modify, or delete sensitive project data by manipulating auto-incrementing object IDs in API requests. Successful exploitation enables unauthorized data access, unauthorized data modification/deletion, and unauthorized project membership escalation.

Impact

Attackers can read, overwrite, and cascade-delete project assets and scripts, as well as add themselves as project members, leading to full compromise of project data integrity and confidentiality.

Recommendation

  • Upgrade Stonewuu ai-fusion-video to version 1.3.0 or later immediately.
  • Review access logs for the affected API paths for abnormal patterns indicative of ID enumeration (e.g., sequential ID requests from a single user session).
  • Implement rate limiting on API endpoints to mitigate automated enumeration attempts.
]]>highadvisory