CVE-2026-108853

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108853

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108853.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108853

Published

2026-10-11T13:26:02Z

Modified

2026-10-28T02:30:32Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

Details

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assistant IDs to permanently delete victims' applications, workflows, conversations, and associated data.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108853.json"
}

References

Affected packages

Git / github.com/unicomai/wanwu

Affected ranges

Type

GIT

Repo

https://github.com/unicomai/wanwu

Events

Introduced

Fixed

88dd0894243fccbc1745eb04d2c5dc61ad1af0b6

Fixed

13d0b225ec237d5a0b44730b2331efadaeb462a2

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.6.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "13d0b225ec237d5a0b44730b2331efadaeb462a2"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.6.3",
            "range": [
                {
                    "fixed": "88dd0894243fccbc1745eb04d2c5dc61ad1af0b6"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.1.2

v0.1.3

v0.1.3-dc97f77

v0.1.5

v0.1.7

v0.1.8

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.5

v0.5.0

v0.5.1

v0.5.10

v0.5.2

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108853.json"