iflytek/skillhub vulnerabilities

Latest iflytek/skillhub CVEs

Newest publication first

1. CVE-2026-110211 SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint

   Published 2026-10-13

   High·CVSS 7.2 EPSS 0.43%

   iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and tri...

2. CVE-2026-108550 SkillHub before 0.2.22 Account Takeover via Account Merge Flow

   Published 2026-10-10

   High·CVSS 8.7 EPSS 0.30%

   SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target usern...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.