Insecure Direct Object Reference in UnicomAI Wanwu Affects Application Management

CVE-2026-108853

What is CVE-2026-108853?

UnicomAI Wanwu prior to version 0.6.3 is susceptible to an insecure direct object reference vulnerability. This flaw allows authenticated low-privileged users to delete applications, workflows, conversations, and their associated data belonging to other tenants. By manipulating the appId, users can exploit the DELETE request to /v1/appspace/app, thereby executing unauthorized deletions of critical application components. It is crucial for organizations using this software to implement the necessary patches to safeguard against potential data loss and disruption.

References