Threats tagged 'ghsa-66jm-x353-x3mc'

Stonewuu ai-fusion-video versions before 1.3.0 have an insecure direct object reference (IDOR) vulnerability. Authenticated users can exploit this flaw by supplying unscoped object IDs to access other users' projects. This allows attackers to enumerate auto-increment IDs on API endpoints such as /api/project, /api/asset, and /api/script. Exploitation can lead to unauthorized reading, overwriting, cascade deletion of data, and adding themselves as project members.