CVE-2026-108853

{
  "etk_id": "ETK-2026-1258",
  "cve_id": "CVE-2026-108853",
  "display_id": "CVE-2026-108853",
  "ghsa_id": "GHSA-fg7x-9rxv-3m3p",
  "euvd_id": "EUVD-2026-97004",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-tenant object access flaw in UnicomAI Wanwu",
  "summary": "UnicomAI Wanwu versions before 0.6.3 do not adequately enforce tenant authorization when deleting applications. An authenticated user with limited privileges may delete applications belonging to other tenants, along with related workflows, conversations, and data.",
  "mitigation": "Upgrade UnicomAI Wanwu to version 0.6.3 or later. Until upgraded, restrict low-privileged user access and monitor application-deletion activity.",
  "vendor": "UnicomAI",
  "product": "Wanwu",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 0.6.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "0.6.3"
      ],
      "package_name": "Wanwu",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": 0.003,
  "epss_percentile": 0.2149,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 83.13013681666666,
  "t0_at": "2026-10-11T13:26:02.706000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-11T13:26:02.706000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-11T13:26:02.706000+00:00",
      "url": "https://github.com/advisories/GHSA-fg7x-9rxv-3m3p"
    }
  }
}