Description
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Published: 2026-10-13
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a missing ownership check in the SkillHub CLI delete endpoint, allowing any authenticated user to permanently delete other users' skills. Attackers can locate target skills via the anonymous search endpoint and then trigger a DELETE request to /api/cli/v1/skills/{namespace}/{slug}, which removes all versions, files, reviews, ratings, and metadata associated with the skill. The primary impact is loss of user data and potential service disruption for the skill owner.

Affected Systems

The affected system is iFlytek SkillHub, version 0.2.22. No other versions are known to be impacted according to the vendor's CNA records.

Risk and Exploitability

The CVSS score of 7.2 indicates a moderate severity and the vulnerability can be exploited by any authenticated user, meaning the attack vector is remote over the network. Although the EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog, an attacker with valid credentials could delete another user's content, underscoring the importance of applying a fix promptly.

Generated by OpenCVE AI on October 17, 2026 at 06:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor's website or repository for a patched release of iFlytek SkillHub that addresses the missing authorization issue and apply any available update.
  • If an upgrade cannot be performed immediately, modify the server or application code to enforce an ownership check, ensuring that only the owner or privileged users can issue DELETE /api/cli/v1/skills/{namespace}/{slug}.
  • Continuously monitor API logs for DELETE requests to the skill endpoint and alert administrators to any unauthorized attempts.

Generated by OpenCVE AI on October 17, 2026 at 06:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 10 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Iflytek
Iflytek skillhub
Vendors & Products Iflytek
Iflytek skillhub

Tue, 13 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Title SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}

cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Iflytek Skillhub
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T22:28:56.865Z

Reserved: 2026-10-13T17:59:14.432Z

Link: CVE-2026-110211

cve-icon Vulnrichment

Updated: 2026-10-16T22:28:51.711Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:18:45.037

Modified: 2026-10-16T23:16:59.837

Link: CVE-2026-110211

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T06:45:05Z

Weaknesses