CVE-2026-121940

AI video project APIs allow another user to read or delete work

Stonewuu · ai-fusion-video project, asset and script APIs

First documented disclosure · Review checkpoint

Summary

An ordinary account can use sequential IDs to reach another user’s video projects, assets or scripts.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: The researcher followed the code paths without making live requests. No malicious exploitation is documented.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The affected controllers check login but use object IDs without enforcing membership or ownership on the relevant actions.

Conditions required

An authenticated account can request another project’s object IDs on a shared installation.

Potential impact

Actions include reading material, overwriting scripts or assets, adding oneself as a member and deleting a project with its child records.

Affected versions and configurations

The CNA lists versions before 1.3.0. The researcher confirmed the vulnerable paths in v1.2.0 source.

Fix and mitigation status

1.3.0 contains commit 4724a1a, identified by the CNA as the permissions fix.

Practical next steps

Deploy a supported release containing the fix. Review project membership changes and deletions made by unrelated accounts.

Operating lesson

Check access separately on each project, child object and operation, including actions that change membership.

Evidence and limits

The public issue was filed October 22. The fix commit followed October 24. The 1.3.0 release and CVE publication followed November 4. The earliest affected tag was not established by the researcher.

Sources