UnicomAI Wanwu CVE-2026-108855

Requires a valid, enabled, authenticated user account on the Wanwu platform (PR:L) - exploitation is not possible unauthenticated. Given such an account, no non-default configuration is needed: the attacker simply supplies a target appId and appType (obtainable from the exploration marketplace) to the unpublish endpoint (DELETE /v1/appspace/app/publish), and the server deletes api_key rows belonging to other users across organizations without verifying ownership. The primary limiting factors are the need for an enabled account and a multi-tenant deployment where other users'/organizations' apps exist to target; impact is confined to revoking API keys (DoS of MCP/OpenAPI access) rather than reading or exfiltrating data.

This is a genuine but moderate-severity access-control flaw, not a critical priority. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) is internally consistent with the description: network-reachable, low attack complexity, requires a low-privilege authenticated account (PR:L), no user interaction, with limited integrity/availability impact and no confidentiality exposure - matching CWE-862 Missing Authorization. The real-world damage is a cross-tenant denial of service (deleting other users' api_key rows), not data theft or code execution, which caps the severity. No EPSS score, KEV listing, or POC/exploit code was provided in the input; a HackMD technical write-up and the vendor source-code line references exist but do not themselves constitute weaponized exploit code. SSVC-style reasoning: exploitation status is 'none/public-write-up only', technical impact is partial, and while the action is trivially scriptable, the prerequisite of a valid enabled account on a niche open-source platform limits mass exploitation. Net: a real multi-tenant authorization bug worth patching for operators of this platform, but low likelihood of widespread opportunistic exploitation.

An attacker who holds any valid, enabled low-privilege account on a shared Wanwu instance browses the exploration marketplace to obtain another organization's appId and appType, then calls the unpublish endpoint for that app. Because the server never checks ownership, the victim's api_key rows are deleted, immediately severing their MCP and OpenAPI client integrations. No public exploit code was identified at time of analysis, though a detailed technical write-up describing the flaw exists.