UnicomAI Wanwu CVE-2026-108853

Requires a valid authenticated low-privileged account on a Wanwu instance running a version before 0.6.3 (PR:L), and a multi-tenant deployment where other tenants' agent or RAG applications exist to be targeted. The core prerequisite is that the pre-patch DELETE /v1/appspace/app handler performs no ownership check tying the supplied appId to the caller's user/org; exploitation is further eased because assistant appIds are sequential and therefore guessable, enabling enumeration. Limiting factors: the attacker must be authenticated (no anonymous/unauthenticated path), no user interaction is required, and the impact is scoped to applications reachable within the same Wanwu instance.

Signals are largely consistent and point to a genuine but bounded integrity/availability risk rather than a critical mass-exploitation threat. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) correctly frames this as a network-reachable, low-complexity attack requiring an authenticated low-privileged account (PR:L), with no confidentiality impact but high integrity and availability impact - matching the description of permanent cross-tenant deletion of applications and data. There is no confidentiality loss because the IDOR enables destruction, not disclosure. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis' despite a detailed technical writeup on HackMD describing the flaw. The SSVC-style picture is: exploitation not observed, automatable=yes (sequential/guessable appIds make enumeration trivial per the description), technical impact=partial-to-total for the victim tenant's data. This is a real priority for anyone running a multi-tenant Wanwu deployment with untrusted tenants, but the PR:L requirement and the niche product footprint cap widespread opportunistic exploitation. The vendor-confirmed patch (ownership/UserId+OrgId checks added) makes remediation straightforward. No conflicting signals were detected; the main gap is the absence of EPSS/KEV/POC data, which is a data-availability limitation, not evidence of low risk.

An attacker registers or already holds a low-privileged account on a shared multi-tenant Wanwu instance, then scripts requests to DELETE /v1/appspace/app iterating over sequential assistant/appId values belonging to other tenants. Because the pre-0.6.3 handler does not verify that the caller owns the target appId, each request permanently destroys a victim tenant's agent or RAG application along with its workflows, conversations, and associated data. A detailed technical writeup exists (HackMD) but no weaponized public exploit code was provided.