CVE-2026-121940 Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121940?
CVE-2026-121940 is a high-severity vulnerability in Stonewuu ai-fusion-video, published on 4 Nov 2026.
Official description
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.
Weakness: CWE-639
Which versions are affected by CVE-2026-121940?
How do I fix CVE-2026-121940?
No fix has been published for CVE-2026-121940 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121940 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-121940 exists.
Sources
Also known as GHSA-66jm-x353-x3mc.