CVE-2026-108855 UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish

UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the exploration marketplace to delete other...