CVE-2026-108855: UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' apikey rows across organizations, cutting off MCP and OpenAPI client access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user whose account is enabled can exploit it. The attacker does not need to own the target application or belong to the target organization.
What access is required to revoke another user's AppKeys?
The attacker needs an authenticated enabled account and a target appId and appType obtainable from the exploration marketplace. They can then invoke the unpublish endpoint to delete api_key rows for arbitrary applications.
What is the operational impact of exploitation?
Exploitation revokes other users' AppKeys, which can cut off MCP and OpenAPI client access. The described impact is loss of integrity and availability rather than disclosure of confidential data.
Which versions are identified as affected?
UnicomAI Wanwu through version 0.6.5 is identified as affected.