CVE-2026-108854

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108854
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108854.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108854
Published
2026-10-11T13:26:03Z
Modified
2026-10-13T02:46:20Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Wanwu before 0.6.3 IDOR AppKey Deletion via DELETE /v1/appspace/app/key
Details

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-639"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108854.json"
}
References

Affected packages

Git / github.com/unicomai/wanwu

Affected ranges

Type
GIT
Repo
https://github.com/unicomai/wanwu
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
88dd0894243fccbc1745eb04d2c5dc61ad1af0b6
Fixed
13d0b225ec237d5a0b44730b2331efadaeb462a2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.6.3"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.2
v0.1.3
v0.1.3-dc97f77
v0.1.5
v0.1.7
v0.1.8
v0.2.0
v0.2.1
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.2.6
v0.2.7
v0.2.8
v0.2.9
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.5
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.6.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108854.json"