SkillHub versions prior to 0.2.22 expose an incorrect authorization flaw in both the service and controller attacker who has already authenticated to the system can exploit the merge flow to assume control of another user’s account. By initiating a merge request with a target username or OAuth identity, the attacker receives a verification token without any requirement for the victim’s approval, then confirms the merge. The result is the attacker inherits the victim’s API tokens, roles, and namespace ownership, enabling full access to the compromised account’s data and resources. The weakness is identified as a glaring authorization bypass, corresponding to CWE‑863, and provides direct control over the victim account once authenticated.

The affected product is SkillHub from iFlytek, versions prior to 0.2.22. No specific sub‑version range is listed beyond the upper bound v0.2.22, so all releases before this point are vulnerable.

The CVSS score of 8.7 indicates high severity. Based on the description, it is inferred that an attacker who has authenticated can exploit the flaw to take over another account by merging and inheriting the victim's API tokens, roles and namespace ownership without additional privileges. Since the EPSS score is not available, the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated session to the merge initiate endpoint; once that prerequisite is met, the attacker can complete the takeover with no further action. The absence of a mitigation mechanism in the current code base allows the merge to be performed freely, making exploitation highly effective for any attacker with basic login capability.