Stonewuu ai-fusion-video lets users reach other users' projects and assets

In this AI video tool, anyone logged in can view and delete others' work.

Summary

ai-fusion-video's project, asset, and script handlers do not check who owns the data. A logged-in user can read, change, or delete other users' and teams' data, and add themselves as project members.

Affected when

A logged-in user account

What to do

Update to 1.3.0 or newer.

Products and platforms

Stonewuu ai-fusion-video

CVE IDs

CVE-2026-121940 (opens in a new tab)

Sources

Write-up: hackmd.io (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab) · hackmd.io (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 12:31 UTC

First seen 2026-11-09 15:20 UTC