{"id":"CVE-2026-108550","published":"2026-10-10T15:16:58.133","lastModified":"2026-10-16T19:18:44.867","description":"SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/iflytek/skillhub","tags":[]},{"url":"https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109","tags":[]},{"url":"https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4","tags":[]},{"url":"https://github.com/iflytek/skillhub/issues/921","tags":[]},{"url":"https://github.com/iflytek/skillhub/releases/tag/v0.2.22","tags":[]},{"url":"https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow","tags":[]}],"exploitRefs":[{"url":"https://github.com/iflytek/skillhub","tags":[]},{"url":"https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth/merge/AccountMergeService.java#L95-L109","tags":[]},{"url":"https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4","tags":[]},{"url":"https://github.com/iflytek/skillhub/issues/921","tags":[]},{"url":"https://github.com/iflytek/skillhub/releases/tag/v0.2.22","tags":[]}],"hasPoc":true,"ai":{"summary":"SkillHub's account merge functionality has incorrect authorization that allows authenticated users to hijack other users' accounts by initiating merges with target usernames or OAuth identities. This leads to complete account takeover where attackers inherit all victim data including API tokens, roles, and namespace ownership.","exploitability":"Moderately easy to exploit as it requires only authentication and access to the merge initiate endpoint, with no additional prerequisites beyond having valid credentials for the target account.","blast_radius":"High impact in real-world scenarios as attackers can gain full administrative control over victim accounts, potentially leading to data exfiltration, privilege escalation, and unauthorized access to sensitive resources like API tokens and namespaces.","remediation":"Apply the patch for SkillHub version 0.2.22 or later to fix the authorization flaw in AccountMergeService and AccountMergeController.","detection":"Monitor for unusual merge initiate requests in application logs that target usernames or OAuth identities not belonging to the requesting user, particularly those with high privilege levels or API token usage patterns.","tags":["auth-bypass","account-takeover","api"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:53:14.178Z"}}