Wanwu
Monthly
Authenticated low-privileged users on UnicomAI Wanwu deployments running versions before 0.6.3 can permanently delete other tenants' agent and RAG applications by sending a DELETE request to /v1/appspace/app with a guessed appId, because the pre-patch handler performs no ownership check on the supplied identifier. The vulnerability is an IDOR (CWE-639) and is exacerbated by sequential, predictable assistant IDs, which makes enumeration of victims' appIds practical; deletion also cascades to associated workflows, conversations, and linked data, giving high integrity and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, vendor score 7.2). Exploitation requires a valid low-privileged account on a multi-tenant instance with other tenants' applications present, and no public exploit code has been identified at time of analysis, though a detailed technical writeup and patch commit are publicly available.
Authorization bypass in UnicomAI Wanwu through 0.6.5 allows any authenticated user to mint an AppKey bound to another user's MCP server by POSTing that victim's MCP server UUID with appType=mcpserver to /v1/appspace/app/key, after which the attacker can open MCP sessions and invoke the victim server's tools under the victim's upstream credentials. The attack is remote with no user interaction, but is gated by valid account credentials (PR:L) and prior knowledge of the target MCP server UUID, which is why the assessed vector carries AC:H and only low confidentiality and integrity impact (C:L/I:L, no availability impact). No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk is low-priority per both the CVSS 4.0 base score of 2.3 and the independent CVSS 3.1 assessment of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Missing authorization in UnicomAI Wanwu through 0.6.5 lets any authenticated, enabled user revoke other users' AppKeys by submitting a target appId and appType - values obtainable from the exploration marketplace - to the unpublish endpoint, which then deletes api_key rows belonging to other users across organizations and cuts off their MCP and OpenAPI client access. Exploitation requires a valid enabled account on the platform (CVSS PR:L, so authenticated, not unauthenticated) and a multi-tenant deployment where other users' or organizations' apps exist to target; the impact is confined to credential revocation (integrity/availability of API access), not data disclosure. Scored 5.3 under CVSS 4.0 with the independent assessment landing at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, this is a genuine but moderate-severity access-control flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Authenticated, enabled users of UnicomAI Wanwu (also tracked as unicomai/wanwu) before version 0.6.3 can revoke other organizations' legacy AppKeys through a broken object-level authorization flaw in the DELETE /v1/appspace/app/key endpoint. Because the handler authorizes deletion solely on the client-supplied numeric apiId and never validates that the caller's userId or orgId owns the key, a low-privileged account can iterate sequential key IDs and invalidate AppKeys tenant-wide, silently breaking MCP and OpenAPI integrations until each owner manually issues replacements. This is a genuine but moderate-priority authorization issue (CWE-639) rather than a critical one: it requires a valid account (PR:L per the CVSS vector), discloses no data, and is limited to integrity/availability impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. Patches are available.
Authenticated low-privileged users on UnicomAI Wanwu deployments running versions before 0.6.3 can permanently delete other tenants' agent and RAG applications by sending a DELETE request to /v1/appspace/app with a guessed appId, because the pre-patch handler performs no ownership check on the supplied identifier. The vulnerability is an IDOR (CWE-639) and is exacerbated by sequential, predictable assistant IDs, which makes enumeration of victims' appIds practical; deletion also cascades to associated workflows, conversations, and linked data, giving high integrity and availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, vendor score 7.2). Exploitation requires a valid low-privileged account on a multi-tenant instance with other tenants' applications present, and no public exploit code has been identified at time of analysis, though a detailed technical writeup and patch commit are publicly available.
Authorization bypass in UnicomAI Wanwu through 0.6.5 allows any authenticated user to mint an AppKey bound to another user's MCP server by POSTing that victim's MCP server UUID with appType=mcpserver to /v1/appspace/app/key, after which the attacker can open MCP sessions and invoke the victim server's tools under the victim's upstream credentials. The attack is remote with no user interaction, but is gated by valid account credentials (PR:L) and prior knowledge of the target MCP server UUID, which is why the assessed vector carries AC:H and only low confidentiality and integrity impact (C:L/I:L, no availability impact). No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk is low-priority per both the CVSS 4.0 base score of 2.3 and the independent CVSS 3.1 assessment of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Missing authorization in UnicomAI Wanwu through 0.6.5 lets any authenticated, enabled user revoke other users' AppKeys by submitting a target appId and appType - values obtainable from the exploration marketplace - to the unpublish endpoint, which then deletes api_key rows belonging to other users across organizations and cuts off their MCP and OpenAPI client access. Exploitation requires a valid enabled account on the platform (CVSS PR:L, so authenticated, not unauthenticated) and a multi-tenant deployment where other users' or organizations' apps exist to target; the impact is confined to credential revocation (integrity/availability of API access), not data disclosure. Scored 5.3 under CVSS 4.0 with the independent assessment landing at CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, this is a genuine but moderate-severity access-control flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Authenticated, enabled users of UnicomAI Wanwu (also tracked as unicomai/wanwu) before version 0.6.3 can revoke other organizations' legacy AppKeys through a broken object-level authorization flaw in the DELETE /v1/appspace/app/key endpoint. Because the handler authorizes deletion solely on the client-supplied numeric apiId and never validates that the caller's userId or orgId owns the key, a low-privileged account can iterate sequential key IDs and invalidate AppKeys tenant-wide, silently breaking MCP and OpenAPI integrations until each owner manually issues replacements. This is a genuine but moderate-priority authorization issue (CWE-639) rather than a critical one: it requires a valid account (PR:L per the CVSS vector), discloses no data, and is limited to integrity/availability impact, and no public exploit code or confirmed active exploitation was identified at time of analysis. Patches are available.