skillhub vulnerabilities

2 known vulnerabilities in skillhub from iFlytek. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  skillhub: Missing Authorization

  CVE-2026-110211Oct 13, 2026iFlytek

  iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous sea

• 8.8 High severity

  skillhub: Incorrect Authorization

  CVE-2026-108550Oct 10, 2026iFlytek

  SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint