Dashboard / CVE-2026-124574

CVE-2026-124574

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 61/100
Published: 2026-11-09 Modified: 2026-11-09 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: Low
VI: Low
VA: Low

Description

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

Weakness Classification (2)

Affected Software (14)

VendorProductVersion
chenyme grok2api 3.1.0
chenyme grok2api 3.1.1
chenyme grok2api 3.1.2
chenyme grok2api 3.1.3
chenyme grok2api 3.1.4
chenyme grok2api 3.1.5
chenyme grok2api 3.1.6
chenyme grok2api 3.1.0
chenyme grok2api 3.1.1
chenyme grok2api 3.1.2
chenyme grok2api 3.1.3
chenyme grok2api 3.1.4
chenyme grok2api 3.1.5
chenyme grok2api 3.1.6

References & Advisories (9)

https://vuldb.com/vuln/432920
vdb-entry technical-description
https://vuldb.com/submit/1036006
third-party-advisory
https://vuldb.com/vuln/432920/cti
signature permissions-required

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

EPSS — Exploitation Probability

0.24%
Raw Score 0.002450
Percentile 15.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00245
2026-11-12
0.00245
2026-11-10
0.00245
2026-11-09
0.00245

Intelligence Sources

mitre ref →
nvd ref →

External Links