Is CVE-2026-108854 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108854?

CVE-2026-108854 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-108854

Description

Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys.