CVE-2026-108854: Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wanwuto a version that resolves this vulnerability.Fixed in 0.6.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Wanwu user whose account is enabled can exploit it. The attacker does not need ownership of the targeted AppKey and can target keys belonging to other organizations.
What does an attacker need to do to delete another user's AppKey?
The attacker sends a DELETE request to /v1/appspace/app/key with a numeric apiId for a legacy AppKey. Because key IDs can be sequential, an attacker can iterate IDs to find and revoke other users' keys.
Are deployments using default access controls affected?
The issue affects deployments where authenticated enabled users can reach the DELETE endpoint. No additional administrative privilege is described as necessary.
What is the operational impact of a successful attack?
Deleted legacy AppKeys revoke access for MCP and OpenAPI clients using those keys. Owners must issue replacement keys before affected clients can resume using them.
What version fixes the issue?
Upgrade Wanwu to version 0.6.3 or later. Versions before 0.6.3 are affected.