SkillHub: Incorrect authorization in account merge flow allows account takeover
Summary
SkillHub before 0.2.22 contains an incorrect authorization flaw in the account merge function (AccountMergeService and AccountMergeController). An authenticated user can start a merge with a target username or OAuth identity, receive the verification token directly, and confirm the merge. This lets the attacker take over the victim's account, including API tokens, roles and namespace ownership. The attacker needs a valid account on the instance, but no user interaction is required.
Affected
- iFlytek SkillHub, versions 0 to before 0.2.22 (per CNA record)
- Note: VulDB describes the issue as up to 0.2.21 and lists a different CWE; the CNA data is treated as authoritative.
Fixed in
- Fixed in SkillHub v0.2.22
- Fix commit: 45228996c7dd67f9304dba5b221fef15138a7fc4
Workaround
- No vendor-published workaround for older versions found.
- Interim measures (own assessment, not from vendor): restrict self-registration, limit network access to the instance, and review account-merge activity and API token use in the audit logs.
Exploitation
- No confirmed in-the-wild exploitation known.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof of concept: unknown.
Our recommendation
- Identify all SkillHub instances and their versions.
- Upgrade to v0.2.22 or later after a PostgreSQL backup; plan for Flyway migrations V66 and V67.
- Rotate or reissue API tokens used for automation, as tokens of merged secondary accounts are revoked.
- Review audit logs for account-merge requests and unexpected namespace or token changes, starting from 5 October 2026 (conservative window).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-108550 VulnCheck advisory www.vulncheck.com
- SkillHub release v0.2.22 github.com
- Fix commit 45228996 github.com
- GitHub issue #921 github.com
- Vulnerable code at v0.2.21 github.com
- OSV entry CVE-2026-108550 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:05.
Original description (NVD)
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.
NVD references (6)
- https://github.com/iflytek/skillhub
- https://github.com/iflytek/skillhub/blob/v0.2.21/server/skillhub-auth/src/main/java/com/iflytek/skillhub/auth…
- https://github.com/iflytek/skillhub/commit/45228996c7dd67f9304dba5b221fef15138a7fc4
- https://github.com/iflytek/skillhub/issues/921
- https://github.com/iflytek/skillhub/releases/tag/v0.2.22
- https://www.vulncheck.com/advisories/skillhub-before-0.2.22-account-takeover-via-account-merge-flow
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.