Skip to content
OpenAdvisories

Vendor

UnicomAI

4 known vulnerabilities.

Products

Wanwu 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-108856

    UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting

    UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver …

    UnicomAI Wanwu
  • Medium 5.4
    CVE-2026-108854

    Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key

    Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/a…

    UnicomAI Wanwu
  • Medium 5.4
    CVE-2026-108855

    UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish

    UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the explo…

    UnicomAI Wanwu