# CVE-2026-124574: chenyme grok2api improper authorization in Video Job Retry Handler

Source: https://junglewise.ai/threats/cve-2026-124574-a-vulnerability-was-determined-in-chenyme-grok2api-up-to-3-1-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-124574 · Severity: medium · CVSS 6.3 · Published 2026-11-09

grok2api is an API gateway for Grok services (Build, Web, Console). A vulnerability in the Video Job Retry Handler allows attackers to bypass authorization checks and perform unauthorized actions remotely, potentially gaining access to restricted functionality without proper authentication.

Technologies: [Chenyme Grok2api](https://junglewise.ai/threats/technologies/grok2api). Vendors: [Chenyme](https://junglewise.ai/threats/vendors/chenyme).

## Quick answers

**Is CVE-2026-124574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124574 being exploited in the wild.

**How severe is CVE-2026-124574?** Medium severity, with a CVSS score of 6.3, published 9 November 2026.

**Which products and versions are affected?** Chenyme Grok2api up to 3.1.6.

**Is there a fix for CVE-2026-124574?** Yes: fixed in 3.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124574 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-124574?** Check whether you run Chenyme Grok2api at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.1.7

## Technical details

An improper authorization vulnerability exists in the beginSelectionSession function of the Video Job Retry Handler component (backend/internal/application/gateway/video.go). The vulnerability allows unauthenticated or unauthorized remote network access to bypass authorization controls. The issue has been publicly disclosed and fixed in version 3.1.7 via patch 199b3abecc14907176dae1f1cacf125419caa94d.

## Affected products

- chenyme grok2api up to 3.1.6

## Timeline

- 2026-11-09: disclosed
- 2026-11-09: patched

## References

- [https://github.com/chenyme/grok2api/](https://github.com/chenyme/grok2api/)
- [https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d](https://github.com/chenyme/grok2api/commit/199b3abecc14907176dae1f1cacf125419caa94d)

## Related threats

- [chenyme grok2api enforcement of behavioral workflow vulnerability](https://junglewise.ai/threats/cve-2026-123788-a-security-vulnerability-has-been-detected-in-chenyme-grok2api)
- [chenyme grok2api WebSocket resource exhaustion](https://junglewise.ai/threats/cve-2026-123748-a-security-flaw-has-been-discovered-in-chenyme-grok2api-up-to-3)