Description
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized deletion of user credentials
Action: Patch Now
AI Analysis

Impact

Wanwu prior to version 0.6.3 contains an insecure direct object reference that lets any authenticated user delete other users' legacy AppKeys by specifying a numeric apiId. This deletion capability can be abused to revoke keys for any organization, breaking both the MCP and OpenAPI clients until the rightful owners generate new keys. The flaw is a classic IDOR weakness categorized as CWE-639.

Affected Systems

UnicomAI's Wanwu software, version 0.6.2 and earlier, is affected. Users running these versions expose themselves to the vulnerability.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated to the Wanwu system, but can enumerate sequential apiId values via the DELETE /v1/appspace/app/key endpoint and trigger bulk key deletions across organizations without additional preconditions.

Generated by OpenCVE AI on October 11, 2026 at 15:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Wanwu to version 0.6.3 or later to address the IDOR flaw.
  • Revoke all remaining AppKeys and issue fresh keys for all affected accounts.
  • Implement application‑level checks to ensure only the owner of an AppKey can execute DELETE /v1/appspace/app/key, and consider disabling that ability for non‑privileged users.

Generated by OpenCVE AI on October 11, 2026 at 15:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Unicomai
Unicomai wanwu
Vendors & Products Unicomai
Unicomai wanwu

Sun, 11 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.
Title Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Unicomai Wanwu
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-18T11:53:05.593Z

Reserved: 2026-10-11T13:02:07.621Z

Link: CVE-2026-108854

cve-icon Vulnrichment

Updated: 2026-10-18T11:44:26.275Z

cve-icon NVD

Status : Deferred

Published: 2026-10-11T14:17:05.100

Modified: 2026-10-18T12:17:01.520

Link: CVE-2026-108854

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:57:38Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key