Description
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other users' api_key rows across organizations, cutting off MCP and OpenAPI client access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
UnicomAI Wanwu
Default version status: unaffected
0 to ≤ 0.6.5affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/unicomai-wanwu-unpublish-revokes-consumer-appkeys ↗
- https://github.com/UnicomAI/wanwu/blob/v0.6.5/internal/app-service/client/orm/app.go#L48-L68 ↗
- https://github.com/UnicomAI/wanwu ↗
- https://www.vulncheck.com/advisories/unicomai-wanwu-through-0.6.5-missing-authorization-via-delete-v1-appspace-app-publish ↗