CVE-2026-108550

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108550

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108550.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108550

Published

2026-10-10T14:35:04Z

Modified

2026-10-16T02:31:04Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

SkillHub before 0.2.22 Account Takeover via Account Merge Flow

Details

SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108550.json"
}

References

Affected packages

Git / github.com/iflytek/skillhub

Affected ranges

Type

GIT

Repo

https://github.com/iflytek/skillhub

Events

Introduced

Fixed

72429e6f69ac5d04e8314b1eed2f8c055809c9f5

Fixed

45228996c7dd67f9304dba5b221fef15138a7fc4

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.2.22"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

cli-v0.*

cli-v0.1.10

cli-v0.1.11

cli-v0.1.12

cli-v0.1.6

cli-v0.1.8

cli-v0.1.9

v0.*

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.15

v0.2.16

v0.2.17

v0.2.18

v0.2.19

v0.2.2

v0.2.20

v0.2.21

v0.2.3

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108550.json"