CVE-2026-124574 Details
Description
A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.
An improper authorization vulnerability has been identified in Chenyme Grok2API versions through 3.1.6. The issue arises in the Video Job Retry Handler component, specifically within the beginSelectionSession function in backend/internal/application/gateway/video.go. This vulnerability allows for remote exploitation by bypassing client key account scope restrictions, potentially leading to unauthorized access to account resources.
Users are advised to upgrade to Chenyme Grok2API version 3.1.7, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chenyme/grok2api/ | [email protected] | Vendor |
| https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d | [email protected] | Broken LinkSource CodeVendor |
| https://github.com/chenyme/grok2api/issues/1066 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/chenyme/grok2api/pull/1067 | [email protected] | Issue TrackingVendor |
| https://github.com/chenyme/grok2api/releases/tag/v3.1.7 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-124574 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1036006 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/432920 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/432920/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chenyme grok2api | <= 3.1.6 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 9, 2026 | New CVE Received | [email protected] |