LingGuoAI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH LingGuoAI CVE published 2026-10-16

CVE-2026-111722

CVE-2026-111722 is an insecure direct object reference vulnerability in LingGuo-Drama through commit 8a6924a, allowing registered users to access other users' projects via the /admin/v1/projects/:id API. The vulnerability exists because projects.Get lacks an owner check, enabling self-registered attackers to iterate numeric IDs to read, overwrite, reassign, or delete any user's short-drama projects.