Missing Authorization in iFlytek SkillHub Enables Unauthorized Skill Deletion
CVE-2026-110211

7.2HIGH

Key Information:

Vendor

Iflytek

Status
Skillhub
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110211?

The iFlytek SkillHub version 0.2.22 contains a significant vulnerability that allows any authenticated user to permanently delete other users' skills without proper ownership checks. This is executed through the DELETE /api/cli/v1/skills/{namespace}/{slug} endpoint. Attackers can exploit this flaw by first identifying their targets using the anonymous search feature and subsequently perform skill deletions, erasing all associated versions, files, reviews, ratings, and metadata. This vulnerability poses serious risks to user data integrity and trust.

Affected Version(s)

skillhub 0 <= 0.2.22

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/skillhub-cli-sk...
third-party-advisory
https://github.com/iflytek/skillhub/blob/v0.2.22/server/s...
technical-description
https://github.com/iflytek/skillhub/blob/v0.2.22/server/s...
technical-description

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.