CVE-2026-108853 in Wanwu
Summary
by MITRE • 10/11/2026
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspace/app with guessed sequential assistant IDs to permanently delete victims' applications, workflows, conversations, and associated data.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in UnicomAI Wanwu versions prior to 0.6.3 represents a critical failure in access control mechanisms, specifically categorized as an Insecure Direct Object Reference or IDOR. This flaw stems from the application's reliance on client-supplied identifiers without adequate server-side validation against the authenticated user's permissions and tenant boundaries. The core technical deficiency lies in the API endpoint DELETE /v1/appspace/app, which accepts an appId parameter to identify the target resource for deletion. Instead of verifying that the requesting user owns or has explicit administrative rights over the specific application identified by this ID, the system blindly processes the request based solely on the presence of a valid authentication token and the syntactic validity of the provided identifier. This architectural oversight allows any authenticated user with low-level privileges to bypass intended isolation boundaries between different tenants within the multi-tenant architecture.
The operational impact of this vulnerability is severe due to its potential for data destruction and service disruption. An attacker can exploit this flaw by crafting HTTP DELETE requests that target specific application IDs belonging to other users or organizations sharing the same instance. Because many systems utilize sequential integer-based identifiers, attackers can employ automated scripts to guess these IDs through brute-force techniques, systematically iterating through a range of probable values. Upon successful identification of a valid appId associated with another tenant's resources, the attacker can permanently delete not only the application itself but also all linked assets such as workflows, conversation histories, and associated data configurations. This results in irreversible loss of intellectual property, customer interaction records, and operational continuity for the victimized tenants, constituting a significant integrity violation that undermines trust in the platform's security posture.
From a classification perspective, this vulnerability aligns with CWE-639, which describes issues related to authorization bypass through direct object references. It also maps directly to MITRE ATT&CK technique T1485.002, specifically Data Destruction on Cloud Infrastructure via application-level exploitation rather than infrastructure compromise. The attack vector is classified as remote and requires authentication, placing it within the Initial Access or Persistence phases depending on whether the deleted applications are used for further malicious activities, though primarily it serves as a destructive action in the Impact phase of the kill chain.
Mitigation strategies must focus on implementing robust authorization checks at the API level. Developers should enforce strict ownership verification by ensuring that every request to modify or delete resources includes server-side validation confirming that the authenticated user's identity matches the owner field associated with the target resource ID. Additionally, adopting UUIDs instead of sequential integers for application identifiers can significantly reduce the feasibility of brute-force guessing attacks. Implementing rate limiting and anomaly detection on DELETE endpoints can also help identify and block automated enumeration attempts. Immediate patching to version 0.6.3 or later is required to resolve this issue, alongside a thorough audit of other API endpoints that handle resource manipulation to ensure consistent enforcement of multi-tenant isolation policies across the entire application surface area.