CVE-2026-124574

CVSS 6.3 (medium) · published 2026-11-09

A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipulation causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.7 is able to resolve this issue. Patch name: 199b3abecc14907176dae1f1cacf125419caa94d. It is suggested to upgrade the affected component.

Weakness: CWE-266, CWE-285

Source: NVD CVE-2026-124574

References

• https://github.com/chenyme/grok2api/
• https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d
• https://github.com/chenyme/grok2api/issues/1066
• https://github.com/chenyme/grok2api/pull/1067
• https://github.com/chenyme/grok2api/releases/tag/v3.1.7
• https://vuldb.com/cve/CVE-2026-124574
• https://vuldb.com/submit/1036006
• https://vuldb.com/vuln/432920
• https://vuldb.com/vuln/432920/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.