Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: UnicomAI Clear all filters
TI-2026-70746 CVE-2026-108856 · GHSA-5pv8-92g5-57vm

Authorization bypass in UnicomAI Wanwu AppKey minting

Priority MEDIUM 45

UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.0028 Published 2026-10-11 No fix listed CWE-639
TI-2026-70745 CVE-2026-108855 · GHSA-fhx6-5hpr-jhgm

Missing authorization in UnicomAI Wanwu allows AppKey revocation

Priority LOW 29

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00219 Published 2026-10-11 No fix listed CWE-862
TI-2026-70744 CVE-2026-108854 · GHSA-975v-7377-g4qf

Insecure direct object reference in UnicomAI Wanwu lets users delete AppKeys

Priority LOW 23

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00227 Published 2026-10-11 Fixed in 0.6.3 CWE-639
TI-2026-70743 CVE-2026-108853 · GHSA-fg7x-9rxv-3m3p

UnicomAI Wanwu IDOR lets users delete other tenants' apps

Priority HIGH 65

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00366 Published 2026-10-11 Fixed in 0.6.3 CWE-639