CVE-2026-108854
Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
UnicomAI Wanwu
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.6.3WanwuCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.
Text from CVE List
Affected versions 1
- Wanwuaffected: all versions before 0.6.3CVE List
References 6
- github.com/UnicomAI/wanwu/commit/13d0b225ec237d5a0b44730b2331efadaeb462a2Fixvia CVE List
- github.com/UnicomAI/wanwu/releases/tag/v0.6.3Fixvia CVE List
- hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-appkey-delete-id-bolaAdvisoryvia CVE List
- vulncheck.com/advisories/wanwu-before-0.6.3-idor-appkey-deletion-via-delete-v1-appspace-app-keyAdvisoryvia CVE List
- github.com/UnicomAI/wanwu/blob/v0.6.2/internal/app-service/client/orm/app_key.go#L26-L31Referencevia CVE List
- github.com/UnicomAI/wanwuReferencevia CVE List