Ai Fusion Video
Monthly
Stonewuu ai-fusion-video releases before 1.3.0 expose an insecure direct object reference in the /api/project, /api/asset and /api/script REST handlers, letting any authenticated user read, overwrite or cascade-delete other tenants' projects, assets and scripts, and even add themselves as members of projects they do not own, simply by supplying someone else's unscoped, sequential auto-increment object id. Because the identifiers are enumerable and the controllers never verify ownership, every default deployment below 1.3.0 is affected and the only prerequisite is a valid low-privileged account (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). There is no CISA KEV entry for this issue; a public technical writeup describing the IDOR/BOLA path exists but is not verified as working exploit code, and the vendor has published a fix commit with version 1.3.0 as the fixed release.
Stonewuu ai-fusion-video releases before 1.3.0 expose an insecure direct object reference in the /api/project, /api/asset and /api/script REST handlers, letting any authenticated user read, overwrite or cascade-delete other tenants' projects, assets and scripts, and even add themselves as members of projects they do not own, simply by supplying someone else's unscoped, sequential auto-increment object id. Because the identifiers are enumerable and the controllers never verify ownership, every default deployment below 1.3.0 is affected and the only prerequisite is a valid low-privileged account (CVSS 4.0 base 8.7; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). There is no CISA KEV entry for this issue; a public technical writeup describing the IDOR/BOLA path exists but is not verified as working exploit code, and the vendor has published a fix commit with version 1.3.0 as the fixed release.