Skillhub
Monthly
Incorrect authorization in iflytek SkillHub before 0.2.22 allows account takeover via the self-service account-merge flow: the merge-initiate endpoint returned the verification token directly to the caller and the verify/confirm steps never required the target account to approve from its own authenticated session, so a single low-privilege authenticated user who knows a victim's username or OAuth identity can complete a merge and inherit that victim's API tokens, roles and namespace ownership. Exploitation requires only a valid SkillHub session (PR:L per the CVSS vector - no administrative rights) and works against default deployments because the API enforces the flow even though the /settings/accounts UI remains redirected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the attack is low-complexity and high-impact, warranting prompt patching; the vendor-released fix is SkillHub 0.2.22.
Incorrect authorization in iflytek SkillHub before 0.2.22 allows account takeover via the self-service account-merge flow: the merge-initiate endpoint returned the verification token directly to the caller and the verify/confirm steps never required the target account to approve from its own authenticated session, so a single low-privilege authenticated user who knows a victim's username or OAuth identity can complete a merge and inherit that victim's API tokens, roles and namespace ownership. Exploitation requires only a valid SkillHub session (PR:L per the CVSS vector - no administrative rights) and works against default deployments because the API enforces the flow even though the /settings/accounts UI remains redirected. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the attack is low-complexity and high-impact, warranting prompt patching; the vendor-released fix is SkillHub 0.2.22.