Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108854Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key

Medium 5.4

In plain English

A medium-severity authorization bypass via user-controlled key in Wanwu from UnicomAI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.

Affected products (as reported)

Vendor	Product	Versions
UnicomAI	Wanwu	0 – before 0.6.3

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-appkey-delete-id-bola third-party-advisory
https://github.com/UnicomAI/wanwu/blob/v0.6.2/internal/app-service/client/orm/app_key.go#L26-L31 technical-description
https://github.com/UnicomAI/wanwu/commit/13d0b225ec237d5a0b44730b2331efadaeb462a2 patch
Wanwu v0.6.3 Release Notes release-notes
https://github.com/UnicomAI/wanwu product
VulnCheck Advisory: Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key third-party-advisory