CVE-2026-108853: UnicomAI Wanwu IDOR in DELETE Endpoint Allowing Cross-Tenant Data Destruction

CVE-2026-108853: UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app Vulnerability Overview Wanwu is a self-hosted multi-tenant AI platform where each user or organization owns their own agents and RAG (Retrieval-Augmented Generation) applications. The BFF endpoint accepts two attacker-controlled values, and , to delete a selected application. In versions v0.6.2 and earlier, this route was registered within the middleware group, which applies and middlewares with a permission level of . This group does not apply the middleware; therefore, the only requirement is an enabled account with a valid session. The handler reads the authenticated and , but the service and downstream deletion paths never use these values for agents or RAG types. The BFF first calls , using only and , and then calls (using only the ) or (using only the ). Each deletion operation filters solely by ID, applying no owner or organization predicates. An enabled account that knows another tenant's and can therefore delete that tenant's agents or RAG applications, along with their associated records. For agents, this triggers a cascade deleting the agent, its workflows, MCPs, tools, multi-agents, snapshots, and conversation records. For RAG applications, it deletes the RAG configuration and its release records. The trust boundary is breached because deletion should be restricted to the owner or an authorized administrator. The same path is already scoped by owner within these services, confirming that the deletion path lacks the checks that would otherwise be applied. Impact Scope Affected Versions: v0.6.2 and earlier (agent path confirmed in v0.6.0, v0.6.1, v0.6.2); release commit: . Fixed in v0.6.3 (2026-08-17). Owner checks also exist in v0.6.4, v0.6.5, current main: Classes: CWE-862 Missing Authorization, CWE-639 Authorization Bypass Through User-Controlled Key Remediation Fixed Version: v0.6.3 Fix Commit: Fix in v0.6.3 (2026-08-17) Detailed Attack Steps 1. Prerequisites: The attacker holds valid credentials for a target self-hosted Wanwu instance running v0.6.2 or earlier. The attacker is not the owner of the target application and does not hold builder or organization administrator roles. The attacker knows a valid victim and the matching (either an agent or RAG). The target application exists. 2. Request Example: The following request examples are illustrative and were not executed against any live deployment. They describe the shape of the request derived from the source. - Authentication: Authenticate as the enabled attacker account and obtain the user JWT issued by the BFF. This token satisfies the requirements of the group for and . - Obtaining Victim Application Identifier: The requirement for a known is a precondition for this report. Market or published application surfaces may expose identifiers, but identifier discovery is not confirmed nor claimed within this report. - Sending Deletion Request: Send the deletion request for the agent application. The payload contains the victim's and . 3. Source-Derived Behavior: The handler passes the attacker's identity and the victim's to . The service calls , which deletes API keys, the application, history, favorites, and URLs by ID and type. The service then calls , which deletes the agent, its workflows, MCPs, tools, multi-agents, snapshots, and conversation records by agent ID. None of these operations are filtered by the attacker's identity. ```

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-108853: UnicomAI Wanwu IDOR in DELETE Endpoint Allowing Cross-Tenant Data Destruction

More from this source