CVE-2026-108855 — UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the …
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7