CVE-2026-108855
Received Received - Intake

Missing Authorization in UnicomAI Wanwu Allows API Key Revocation

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108855
EUVD
EUVD-2026-97006

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
UnicomAI Wanwu 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows any authenticated user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can delete other users' API keys by supplying a target appId and appType, cutting off access to MCP and OpenAPI clients.

Detection Guidance

To detect this vulnerability, monitor HTTP DELETE requests to the /v1/appspace/app/publish endpoint. Check for requests with appId and appType parameters from non-owner users. Inspect logs for unauthorized app unpublishing events or unexpected API key deletions across organizations.

Impact Analysis

If exploited, this vulnerability could disrupt access to critical applications for other users, leading to service outages or unauthorized removal of API access. It may also allow attackers to manipulate app permissions or disrupt workflows.

Compliance Impact

This vulnerability could lead to unauthorized access or disruption of services, potentially violating data integrity and availability requirements in GDPR and HIPAA. Unauthorized revocation of API keys may also impact audit logs and accountability.

Mitigation Strategies

Immediately update UnicomAI Wanwu to the latest version beyond 0.6.5 to patch the missing authorization flaw. Review user access logs for suspicious activity related to appKey revocations. Restrict authenticated user permissions to prevent unauthorized actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart