Search

Find a vulnerability

Search criteria

    4 vulnerabilities found for skillhub by iflytek

    CVE-2026-110211 (GCVE-0-2026-110211)

    Vulnerability from nvd – Published: 2026-10-13 18:50 – Updated: 2026-10-13 18:50
    VLAI
    Title
    SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
    Summary
    iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
    Severity
    7.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 5953 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    iflytek skillhub Affected: 0 , ≤ 0.2.22 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-13 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/iflytek/skillhub",
          "product": "skillhub",
          "repo": "https://github.com/iflytek/skillhub",
          "vendor": "iflytek",
          "versions": [
            {
              "lessThanOrEqual": "0.2.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users\u0027 skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:50:01.273Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Advisory",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skillhub-cli-skill-delete-missing-ownership-check"
        },
        {
          "name": "Vulnerable Code: SkillDeleteAppService (v0.2.22)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/SkillDeleteAppService.java#L95-L127"
        },
        {
          "name": "CliSkillController.deleteRemote (v0.2.22)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliSkillController.java#L88-L96"
        },
        {
          "name": "CliSkillAppService.deleteRemote (v0.2.22)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/cli/CliSkillAppService.java#L149-L161"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/iflytek/skillhub"
        },
        {
          "name": "VulnCheck Advisory: SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/skillhub-through-0.2.22-missing-authorization-in-cli-skill-delete-endpoint"
        }
      ],
      "title": "SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110211",
    "datePublished": "2026-10-13T18:50:01.273Z",
    "dateReserved": "2026-10-13T17:59:14.432Z",
    "dateUpdated": "2026-10-13T18:50:01.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-108550 (GCVE-0-2026-108550)

    Vulnerability from nvd – Published: 2026-10-10 14:35 – Updated: 2026-10-10 14:35
    VLAI
    Title
    SkillHub before 0.2.22 Account Takeover via Account Merge Flow
    Summary
    SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 5953 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    iflytek skillhub Affected: 0 , < 0.2.22 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-05 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "skillhub",
          "vendor": "iflytek",
          "versions": [
            {
              "lessThan": "0.2.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim\u0027s API tokens, roles and namespace ownership."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T14:35:04.943Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #921",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/iflytek/skillhub/issues/921"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/iflytek/skillhub"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4"
        },
        {
          "name": "skillhub v0.2.22 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/iflytek/skillhub/releases/tag/v0.2.22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109"
        },
        {
          "name": "VulnCheck Advisory: SkillHub before 0.2.22 Account Takeover via Account Merge Flow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow"
        }
      ],
      "title": "SkillHub before 0.2.22 Account Takeover via Account Merge Flow",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108550",
    "datePublished": "2026-10-10T14:35:04.943Z",
    "dateReserved": "2026-10-10T14:24:43.249Z",
    "dateUpdated": "2026-10-10T14:35:04.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-110211 (GCVE-0-2026-110211)

    Vulnerability from cvelistv5 – Published: 2026-10-13 18:50 – Updated: 2026-10-13 18:50
    VLAI
    Title
    SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
    Summary
    iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
    Severity
    7.2 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
    8.1 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 5953 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    iflytek skillhub Affected: 0 , ≤ 0.2.22 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-13 00:00
    Credits
    hieuPenguinnn
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/iflytek/skillhub",
          "product": "skillhub",
          "repo": "https://github.com/iflytek/skillhub",
          "vendor": "iflytek",
          "versions": [
            {
              "lessThanOrEqual": "0.2.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "hieuPenguinnn"
        }
      ],
      "datePublic": "2026-10-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users\u0027 skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-13T18:50:01.273Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Researcher Advisory",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skillhub-cli-skill-delete-missing-ownership-check"
        },
        {
          "name": "Vulnerable Code: SkillDeleteAppService (v0.2.22)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/SkillDeleteAppService.java#L95-L127"
        },
        {
          "name": "CliSkillController.deleteRemote (v0.2.22)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliSkillController.java#L88-L96"
        },
        {
          "name": "CliSkillAppService.deleteRemote (v0.2.22)",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.22/server/skillhub-app/src/main/java/com/iflytek/skillhub/service/cli/CliSkillAppService.java#L149-L161"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/iflytek/skillhub"
        },
        {
          "name": "VulnCheck Advisory: SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/skillhub-through-0.2.22-missing-authorization-in-cli-skill-delete-endpoint"
        }
      ],
      "title": "SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-110211",
    "datePublished": "2026-10-13T18:50:01.273Z",
    "dateReserved": "2026-10-13T17:59:14.432Z",
    "dateUpdated": "2026-10-13T18:50:01.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-108550 (GCVE-0-2026-108550)

    Vulnerability from cvelistv5 – Published: 2026-10-10 14:35 – Updated: 2026-10-10 14:35
    VLAI
    Title
    SkillHub before 0.2.22 Account Takeover via Account Merge Flow
    Summary
    SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    8.8 (High)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 5953 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    iflytek skillhub Affected: 0 , < 0.2.22 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-05 00:00
    Credits
    George Chen
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "skillhub",
          "vendor": "iflytek",
          "versions": [
            {
              "lessThan": "0.2.22",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim\u0027s API tokens, roles and namespace ownership."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T14:35:04.943Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #921",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/iflytek/skillhub/issues/921"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/iflytek/skillhub"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4"
        },
        {
          "name": "skillhub v0.2.22 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/iflytek/skillhub/releases/tag/v0.2.22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109"
        },
        {
          "name": "VulnCheck Advisory: SkillHub before 0.2.22 Account Takeover via Account Merge Flow",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow"
        }
      ],
      "title": "SkillHub before 0.2.22 Account Takeover via Account Merge Flow",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108550",
    "datePublished": "2026-10-10T14:35:04.943Z",
    "dateReserved": "2026-10-10T14:24:43.249Z",
    "dateUpdated": "2026-10-10T14:35:04.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}