CVE-2026-110209

🗓️ 13 Oct 2026 18:50:00Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 23 Views🌐 WEB

Authenticated non-admin users can read stored credentials via ai-fusion-video endpoints.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-110209	13 Oct 202619:08	–	circl
CNNVD	Stone Wu’s authorization issues and vulnerabilities	12 Oct 202616:00	–	cnnvd
Cvelist	CVE-2026-110209 ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials	13 Oct 202618:50	–	cvelist
EUVD	EUVD-2026-99250	13 Oct 202618:50	–	euvd
Mend	CVE-2026-110209	13 Oct 202618:50	–	mend
NVD	CVE-2026-110209	13 Oct 202619:18	–	nvd
osv_cve	CVE-2026-110209 ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials	13 Oct 202618:50	–	osv_cve
Positive Technologies	PT-2026-111833	13 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-110209: Missing Authorization	13 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-110209 ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials	13 Oct 202618:50	–	vulnrichment

[
  {
    "vendor": "Stonewuu",
    "product": "ai-fusion-video",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThanOrEqual": "1.2.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "repo": "https://github.com/Stonewuu/ai-fusion-video"
  }
]

Source	Link
hackmd	www.hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ai-fusion-video-broken-access-control-and-upload-path-traversal
vulncheck	www.vulncheck.com/advisories/ai-fusion-video-through-1.2.0-missing-authorization-in-configuration-read-endpoints-exposes-stored-credentials
github	www.github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/system/SystemConfigController.java
github	www.github.com/Stonewuu/ai-fusion-video/blob/v1.2.0/ai-fusion-video/src/main/java/com/stonewu/fusion/controller/ai/ApiConfigController.java

Parameter	Position	Path	Description	CWE
get	path	/api-config/get	Missing authorization on the api-config get endpoint allowing non-admin users to read AI provider API keys and proxy passwords.	CWE-862
list	path	/api-config/list	Missing authorization on the api-config list endpoint allowing non-admin users to read AI provider API keys and proxy passwords.	CWE-862

13 Oct 2026 20:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

CVSS 47.1

EPSS0.00476

SSVC

CWE-862