Incorrect Authorization in SkillHub Allows Account Takeover

CVE-2026-108550

What is CVE-2026-108550?

SkillHub versions prior to 0.2.22 are susceptible to an incorrect authorization flaw within the AccountMergeService and AccountMergeController components. This vulnerability grants authenticated attackers the ability to exploit the account merge flow, enabling them to initiate a merge operation targeting another user's account by providing their username or OAuth identity. By doing so, these attackers can directly obtain a verification token and finalize the merge process, thereby gaining access to the victim's API tokens, user roles, and namespace ownership.

References