EUVD-2026-99252
GHSA-p68j-4998-6884
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain low-privilege account
-
ExploitEnumerate target skills via anonymous search
-
ExecutionSend DELETE request to skill endpoint
-
ImpactPermanently purge victim's skills, files and metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires any valid authenticated low-privilege account on the target SkillHub instance (PR:L) - the flaw is reachable at DELETE /api/cli/v1/skills/{namespace}/{slug}, which performs no ownership check in CliSkillController/SkillDeleteAppService. Target identification needs no credentials because the skill search endpoint is anonymous. No user interaction, no admin rights, and no non-default configuration are needed; exploitation works against default deployments. The practical limiting factor is account access: instances that disable self-registration or restrict accounts to trusted users materially reduce exposure, while publicly-registerable or multi-tenant instances are fully exposed. |
| Impact | This is a genuine medium-to-high operational risk for anyone running iFlytek SkillHub, but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H) is internally consistent with the description: a network-reachable API endpoint, low attack complexity, and only a low-privilege authenticated account required, producing high integrity and availability impact through permanent data destruction with no confidentiality loss. CWE-862 (missing authorization) matches the description precisely - authentication works, but ownership/authorization checks are absent. No EPSS score was provided, the vulnerability is NOT in CISA KEV, and no POC flag was supplied, so exploitation is not confirmed in the wild. However, a detailed VulnCheck advisory and a HackMD technical write-up citing the exact vulnerable source lines lower the barrier to weaponization considerably even without packaged exploit code. The main factor tempering raw severity is PR:L: the attacker must first hold a valid account, so this is realistic for multi-tenant or publicly-registerable instances but lower priority for closed single-tenant deployments. |
| Exploit ScenarioDerived | An attacker registers or obtains any low-privilege account on a SkillHub instance, uses the unauthenticated search endpoint to enumerate a victim's skill namespace and slug, then issues DELETE /api/cli/v1/skills/{namespace}/{slug} to permanently destroy that skill including all versions, files, reviews, ratings and metadata. Given AV:N/AC:L and no user interaction, the request is trivially scriptable and repeatable across many targets. No public exploit identified at time of analysis, though VulnCheck and HackMD write-ups document the flaw and vulnerable code paths in detail. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Any authenticated low-privilege user on iFlytek SkillHub through 0.2.22 can permanently destroy other users' skills by calling DELETE /api/cli/v1/skills/{namespace}/{slug}, because the CLI delete path performs no ownership or role check (CWE-862) even though the caller is authenticated (CVSS vector PR:L, no admin rights, no UI interaction, default configuration). Targets are trivial to enumerate because the skill search endpoint is anonymous, and a successful call cascades into a hard purge of every version, file, review, rating and metadata record, giving high integrity and availability impact with no confidentiality impact. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; the practical exposure is highest on publicly registrable or multi-tenant instances, while instances that disable self-registration or restrict accounts to trusted users are materially less exposed.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must be compensating controls until upstream ships a fix; track https://github.com/iflytek/skillhub and the VulnCheck advisory (https://www.vulncheck.com/advisories/skillhub-through-0.2.22-missing-authorization-in-cli-skill-delete-endpoint) plus the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-110211) for an updated release, and confirm the fixed version against the vendor's own release notes rather than assuming a version number. Highest-value control: close account acquisition on the attack path - disable self-registration or restrict SkillHub accounts to a vetted allowlist (trade-off: blocks external contributors and multi-tenant onboarding, and existing low-privilege accounts remain dangerous until rotated). Second: block or restrict DELETE requests to /api/cli/v1/skills/{namespace}/{slug} at the reverse proxy or gateway so only trusted admin identities can reach the CLI delete route, or disable the CLI delete feature entirely (trade-off: breaks legitimate CLI-driven publishing/deletion workflows). Third: treat SkillHub as multi-tenant untrusted - deploy per-team instances or network-isolate the API behind VPN/SSO (trade-off: added operational overhead). Fourth: enable audit logging and alerting on all DELETE calls to /api/cli/v1/skills/* and on anomalous enumeration of the anonymous search endpoint, since absence of ownership checks means the only reliable detector is behavioural. Finally, maintain out-of-band backups of skill content, reviews, ratings and metadata so that destructive deletion can be reversed; note that backups are a recovery control, not a prevention control. Attempts to add an ownership-check patch in a fork are feasible given the public source locations above, but such a change must be validated and maintained as it will diverge from upstream.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
iFlytek SkillHub is a Java/Spring Boot service that stores AI 'skills' and exposes a CLI-facing REST surface under /api/cli/v1. The vulnerable flow is CliSkillController (server/skillhub-app/src/main/java/com/iflytek/skillhub/controller/cli/CliSkillController.java, lines 88-96), which forwards to SkillDeleteAppService (lines 95-127) and CliSkillAppService (lines 149-161) without any ownership, tenant or role verification on the target skill. This is the classic CWE-862 Missing Authorization pattern: the endpoint authenticates the session but never authorizes the subject against the object, so the attacker-supplied {namespace}/{slug} path parameters are trusted implicitly. The delete operation is destructive and cascading, removing all published versions, uploaded files, reviews, ratings and metadata, which is why the impact is scored as VI:H/VA:H with VC:N in the CVSS 4.0 vector (7.2), matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Reconnaissance does not require credentials at all, because the skill search endpoint is anonymous; the only true prerequisite is possession of any valid low-privilege account. The public HackMD writeup (skillhub-cli-skill-delete-missing-ownership-check) documents the missing ownership check, and the VulnCheck advisory cross-references the same NVD/GitHub source locations.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Network API endpoint (AV:N/AC:L), any authenticated user suffices (PR:L), no interaction (UI:N); permanent deletion both destroys and removes data, so I:H and A:H with no confidentiality impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets through the anonymous search endpoint and trigger deletion without ownership checks, purging all versions, files, reviews, ratings and metadata.
Executive ViewAI
iFlytek SkillHub through 0.2.22 contains a high-severity authorization flaw that lets any authenticated low-privilege user permanently delete other users' skills, affecting data integrity and service availability without confidentiality impact. No public exploit identified at time of analysis, but publicly registrable or multi-tenant deployments are most exposed because skill enumeration is anonymous and the delete path performs no ownership or role check. Leadership should treat this as an operational and reputational risk if untrusted users can self-register or reach the API.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling self-registration, restricting accounts to trusted users, blocking or requiring ownership checks for DELETE /api/cli/v1/skills/{namespace}/{slug} at the API gateway/WAF, disabling CLI delete functionality, enforcing least privilege, backing up skill data, and monitoring for unauthorized deletion activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB