UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary app…

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 11, 2026 · NIST NVD

   Detected

   UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.

2. Oct 14, 2026 · NIST NVD

   Updated

   UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.

Sources

• CVE.orgVulnerability recordCVE-2026-108855

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-108855

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2026-108855

  UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to

  nvd.nist.gov

References

• Reference · github.com
• Reference · github.com
• Reference · hackmd.io
• Reference · vulncheck.com