CVE-2026-108855 Details
Description
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.
A missing authorization vulnerability exists in UnicomAI Wanwu versions through 0.6.5. This vulnerability allows any authenticated user to revoke other users' AppKeys for arbitrary applications via the unpublish endpoint. Exploitation involves supplying a target appId and appType, which can be obtained from the exploration marketplace. The vulnerability arises because the unpublish route does not verify if the caller is the app owner, leading to unauthorized AppKey deletions across organizations.
The vulnerability can be fixed by adding an ownership verification step before the unpublish operation is executed. This check should ensure that only the app publisher or an authorized administrator can initiate the unpublish process.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| UnicomAI Wanwu | <= 0.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |